CVE-2026-57186
Asterisk: CVE-2022-37325 fix is absent from current chan_ooh323 Q.931 party-number parser
Asterisk is an open source private branch exchange and telephony toolkit. From 21.0.0-pre1 until Asterisk 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3, the chan_ooh323 Q.931 party-number parser lacks the CVE-2022-37325 fix because that fix was never forward-ported from Asterisk 20 to later versions. Malformed Q.931 elements in an OOH323 request can therefore crash Asterisk. This issue affects Asterisk versions greater than 20. The chan_ooh323 addon channel driver must be explicitly compiled and installed, which is not the default, and its port must be publicly reachable. This issue is fixed in Asterisk 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Asterisk: CVE-2022-37325 fix is absent from current chan_ooh323 Q.931 party-number parser
Asterisk is an open source private branch exchange and telephony toolkit. From 21.0.0-pre1 until Asterisk 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3, the chan_ooh323 Q.931 party-number parser lacks the CVE-2022-37325 fix because that fix was never forward-ported from Asterisk 20 to later versions. Malformed Q.931 elements in an OOH323 request can therefore crash Asterisk. This issue affects Asterisk versions greater than 20. The chan_ooh323 addon channel driver must be explicitly compiled and installed, which is not the default, and its port must be publicly reachable. This issue is fixed in Asterisk 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3.
- Record
CVE-2026-57186- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-839
- Updated
- 2026-11-02
EUVDEUVD-2026-111395
Asterisk is an open source private branch exchange and telephony toolkit. From 21.0.0-pre1 until Asterisk 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3, the chan_ooh323 Q.931 party-number parser lacks the CVE-2022-37325 fix because that fix was never forward-ported from Asterisk 20 to later versions. Malformed Q.931 elements in an OOH323 request can therefore crash Asterisk. This issue affects Asterisk versions greater than 20. The chan_ooh323 addon channel driver must be explicitly compiled and installed, which is not the default, and its port must be publicly reachable. This issue is fixed in Asterisk 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3.
- Record
EUVD-2026-111395- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
NVD
Asterisk is an open source private branch exchange and telephony toolkit. From 21.0.0-pre1 until Asterisk 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3, the chan_ooh323 Q.931 party-number parser lacks the CVE-2022-37325 fix because that fix was never forward-ported from Asterisk 20 to later versions. Malformed Q.931 elements in an OOH323 request can therefore crash Asterisk. This issue affects Asterisk versions greater than 20. The chan_ooh323 addon channel driver must be explicitly compiled and installed, which is not the default, and its port must be publicly reachable. This issue is fixed in Asterisk 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3.
- Record
CVE-2026-57186- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-839
- Updated
- 2026-11-02
OSV
Asterisk: CVE-2022-37325 fix is absent from current chan_ooh323 Q.931 party-number parser
Asterisk is an open source private branch exchange and telephony toolkit. From 21.0.0-pre1 until Asterisk 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3, the chan_ooh323 Q.931 party-number parser lacks the CVE-2022-37325 fix because that fix was never forward-ported from Asterisk 20 to later versions. Malformed Q.931 elements in an OOH323 request can therefore crash Asterisk. This issue affects Asterisk versions greater than 20. The chan_ooh323 addon channel driver must be explicitly compiled and installed, which is not the default, and its port must be publicly reachable. This issue is fixed in Asterisk 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3.
- Record
CVE-2026-57186- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-839
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-57186
Asterisk is an open source private branch exchange and telephony toolkit. From 21.0.0-pre1 until Asterisk 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3, the chan_ooh323 Q.931 party-number parser lacks the CVE-2022-37325 fix because that fix was never forward-ported from Asterisk 20 to later versions. Malformed Q.931 elements in an OOH323 request can therefore crash Asterisk. This issue affects Asterisk versions greater than 20. The chan_ooh323 addon channel driver must be explicitly compiled and installed, which is not the default, and its port must be publicly reachable. This issue is fixed in Asterisk 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3.
- Record
DEBIAN-CVE-2026-57186- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-57186
Asterisk is an open source private branch exchange and telephony toolkit. From 21.0.0-pre1 until Asterisk 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3, the chan_ooh323 Q.931 party-number parser lacks the CVE-2022-37325 fix because that fix was never forward-ported from Asterisk 20 to later versions. Malformed Q.931 elements in an OOH323 request can therefore crash Asterisk. This issue affects Asterisk versions greater than 20. The chan_ooh323 addon channel driver must be explicitly compiled and installed, which is not the default, and its port must be publicly reachable. This issue is fixed in Asterisk 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3.
- Record
UBUNTU-CVE-2026-57186- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
asteriskDebian:14 |
before 1:22.10.1+dfsg+~cs6.17.60671434-1, plus listed versions 0.1.11-30.1.11-3woody11:1.0.5-21:1.0.5-41:1.0.6-1 Show 45 moreShow less1:1.0.6-21:1.0.7-11:1.0.7.dfsg.1-11:1.0.7.dfsg.1-21:1.0.7.dfsg.1-2sarge11:1.0.7.dfsg.1-2sarge21:1.0.7.dfsg.1-2sarge31:1.0.7.dfsg.1-2sarge41:1.0.7.dfsg.1-2sarge51:1.0.7.dfsg.1-2sarge61:1.0.9.dfsg-11:1.0.9.dfsg-31:1.0.9.dfsg-41:1.0.9.dfsg-51:1.0.9.dfsg-61:1.2.0-beta1.dfsg-11:1.2.0-beta2.dfsg-11:1.2.0-beta2.dfsg-21:1.2.0-beta2.dfsg-31:1.2.0-rc1.dfsg-11:1.2.0-rc2.dfsg-11:1.2.0.dfsg-11:1.2.0.dfsg-21:1.2.0.dfsg-31:1.2.0.dfsg-41:1.2.0.dfsg-51:1.2.0.dfsg-61:1.2.1.dfsg-11:1.2.1.dfsg-21:1.2.1.dfsg-31:1.2.10.dfsg-11:1.2.10.dfsg-1bpo11:1.2.10.dfsg-21:1.2.10.dfsg-31:1.2.11.dfsg-11:1.2.12.1.dfsg-11:1.2.13~dfsg-11:1.2.13~dfsg-21:1.2.13~dfsg-2etch11:1.2.13~dfsg-2etch21:1.2.13~dfsg-2etch31:1.2.13~dfsg-2etch41:1.2.14~dfsg-11:1.2.14~dfsg-21:1.2.14~dfsg-3 |
1:22.10.1+dfsg+~cs6.17.60671434-1 |
asteriskUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 1:13.1.0~dfsg-1.1ubuntu31:13.1.0~dfsg-1.1ubuntu41:13.1.0~dfsg-1.1ubuntu4.11:13.1.0~dfsg-1.1ubuntu4.1+esm1 |
None known |
asteriskUbuntu:18.04:LTS |
All versions, plus listed versions 1:13.17.2~dfsg-1ubuntu11:13.17.2~dfsg-2ubuntu11:13.18.1~dfsg-1ubuntu11:13.18.3~dfsg-1ubuntu11:13.18.3~dfsg-1ubuntu21:13.18.3~dfsg-1ubuntu31:13.18.3~dfsg-1ubuntu4 |
None known |
asteriskUbuntu:20.04:LTS |
All versions, plus listed versions 1:16.2.1~dfsg-2build21:16.2.1~dfsg-2build31:16.2.1~dfsg-2ubuntu1 |
None known |
asteriskUbuntu:22.04:LTS |
All versions, plus listed versions 1:16.16.1~dfsg-21:16.16.1~dfsg-41:16.16.1~dfsg-4build11:16.16.1~dfsg+~2.10-11:18.10.0~dfsg+~cs6.10.40431411-2 |
None known |
asteriskUbuntu:24.04:LTS |
All versions, plus listed versions 1:20.4.0~dfsg+~cs6.13.40431414-21:20.5.0~dfsg+~cs6.13.40431414-11:20.5.1~dfsg+~cs6.13.40431414-11:20.5.2~dfsg+~cs6.13.40431414-11:20.6.0~dfsg+~cs6.13.40431414-1 Show 4 moreShow less1:20.6.0~dfsg+~cs6.13.40431414-21:20.6.0~dfsg+~cs6.13.40431414-2build31:20.6.0~dfsg+~cs6.13.40431414-2build41:20.6.0~dfsg+~cs6.13.40431414-2build5 |
None known |
asteriskUbuntu:26.10 |
All versions, plus listed versions 1:22.5.2~dfsg+~cs6.15.60671435-11:22.10.0+dfsg+~cs6.17.60671434-1ubuntu21:22.10.0+dfsg+~cs6.17.60671434-1ubuntu3 |
None known |
asteriskUbuntu:26.04:LTS |
All versions, plus listed versions 1:22.5.2~dfsg+~cs6.15.60671435-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-57186 is a high vulnerability (CVSS 7.5) in Asterisk, published October 27, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.60%, the 49th percentile. Fixed in asterisk 1:22.10.1+dfsg+~cs6.17.60671434-1.
References
github.com/asterisk/asterisk/security/advisories/GHSA-h5hv-jmgj-92q2
Show 10 moreShow less
nvd.nist.gov/vuln/detail/CVE-2026-57186
security-tracker.debian.org/tracker/CVE-2026-57186
ubuntu.com/security/CVE-2026-57186
cve.org/CVERecord?id=CVE-2026-57186
Left out here: 244 versions. The JSON record has them.