FKIE_CVE-2026-57184

Vulnerability from fkie_nvd - Published: 2026-10-26 20:17 - Updated: 2026-10-27 15:08
Severity
6.3 (Medium) - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Summary
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, insufficient bounds checking in the `chan_ooh323` `Q.931` `information-element parser` permits an `out-of-bounds read` that may allow an unauthenticated attacker to crash Asterisk using carefully crafted `setup packets`. The `chan_ooh323` addon channel driver must be explicitly compiled and installed, which is not the default, and its port must be publicly reachable. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
References
security-advisories@github.comhttps://github.com/asterisk/asterisk/commit/00ebdfbc89ed160ae45a2fc0f67f36e36dae48ee
security-advisories@github.comhttps://github.com/asterisk/asterisk/commit/437d17fb13503fe9b4e72c35396f0c250d30b0f0
security-advisories@github.comhttps://github.com/asterisk/asterisk/commit/6dba027f8aea35bf3bbd89371a0cf516b13f8588
security-advisories@github.comhttps://github.com/asterisk/asterisk/commit/9c776e348374a72589cf27f635cddef45a2a2b90
security-advisories@github.comhttps://github.com/asterisk/asterisk/commit/ad4a2b3e944afd5a8e9a550bd5f62aeac8680711
security-advisories@github.comhttps://github.com/asterisk/asterisk/commit/b1284510421a29c72fc4e9a31e4b1e0666a0144f
security-advisories@github.comhttps://github.com/asterisk/asterisk/releases/tag/20.20.1
security-advisories@github.comhttps://github.com/asterisk/asterisk/releases/tag/21.12.3
security-advisories@github.comhttps://github.com/asterisk/asterisk/releases/tag/22.10.1
security-advisories@github.comhttps://github.com/asterisk/asterisk/releases/tag/23.4.1
security-advisories@github.comhttps://github.com/asterisk/asterisk/releases/tag/certified-20.7-cert11
security-advisories@github.comhttps://github.com/asterisk/asterisk/releases/tag/certified-22.8-cert3
security-advisories@github.comhttps://github.com/asterisk/asterisk/security/advisories/GHSA-746q-794h-cc7f
security-advisories@github.comhttps://github.com/asterisk/asterisk/tree/24.0.0-pre1
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "asterisk",
          "vendor": "asterisk",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 20.20.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 21.0.0-pre1, \u003c 21.12.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 22.0.0-pre1, \u003c 22.10.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 23.0.0-pre1, \u003c 23.4.1"
            }
          ]
        },
        {
          "product": "certified-asterisk",
          "vendor": "asterisk",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 20.7-cert11"
            },
            {
              "status": "affected",
              "version": "\u003e= 22.8-cert1-pre1, \u003c 22.8-cert3"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, insufficient bounds checking in the `chan_ooh323` `Q.931` `information-element parser` permits an `out-of-bounds read` that may allow an unauthenticated attacker to crash Asterisk using carefully crafted `setup packets`. The `chan_ooh323` addon channel driver must be explicitly compiled and installed, which is not the default, and its port must be publicly reachable. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3."
    }
  ],
  "id": "CVE-2026-57184",
  "lastModified": "2026-10-27T15:08:50.630",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 6.3,
          "baseSeverity": "MEDIUM",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "LOW",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-10-26T20:17:56.517",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/asterisk/asterisk/commit/00ebdfbc89ed160ae45a2fc0f67f36e36dae48ee"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/asterisk/asterisk/commit/437d17fb13503fe9b4e72c35396f0c250d30b0f0"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/asterisk/asterisk/commit/6dba027f8aea35bf3bbd89371a0cf516b13f8588"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/asterisk/asterisk/commit/9c776e348374a72589cf27f635cddef45a2a2b90"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/asterisk/asterisk/commit/ad4a2b3e944afd5a8e9a550bd5f62aeac8680711"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/asterisk/asterisk/commit/b1284510421a29c72fc4e9a31e4b1e0666a0144f"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/asterisk/asterisk/releases/tag/20.20.1"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/asterisk/asterisk/releases/tag/21.12.3"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/asterisk/asterisk/releases/tag/22.10.1"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/asterisk/asterisk/releases/tag/23.4.1"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/asterisk/asterisk/releases/tag/certified-20.7-cert11"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/asterisk/asterisk/releases/tag/certified-22.8-cert3"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-746q-794h-cc7f"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/asterisk/asterisk/tree/24.0.0-pre1"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-125"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.