CVE-2026-57184

Name of the Vulnerable Software and Affected Versions Asterisk versions prior to 20.20.1 Asterisk versions prior to 21.12.3 Asterisk versions prior to 22.10.1 Asterisk versions prior to 23.4.1 Certified Asterisk versions prior to 20.7-cert11 Certified Asterisk versions prior to 22.8-cert3

Description Insufficient bounds checking in the chan ooh323 Q.931 information-element parser allows an unauthenticated attacker to cause a crash via an out-of-bounds read using specially crafted setup packets. This requires the chan ooh323 addon channel driver to be explicitly compiled, installed, and its port to be publicly accessible.

Recommendations Update to version 20.20.1 Update to version 21.12.3 Update to version 22.10.1 Update to version 23.4.1 Update Certified Asterisk to version 20.7-cert11 Update Certified Asterisk to version 22.8-cert3 As a temporary mitigation, avoid compiling or installing the chan ooh323 addon channel driver.