Asterisk is an open source private branch exchange and telephony toolkit. From 21.0.0-pre1 until Asterisk 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3, the `chan_ooh323` `Q.931 party-number parser` lacks the `CVE-2022-37325` fix because that fix was never forward-ported from Asterisk 20 to later versions. Malformed Q.931 elements in an `OOH323 request` can therefore crash Asterisk. This issue affects Asterisk versions greater than 20. The `chan_ooh323` addon channel driver must be explicitly compiled and installed, which is not the default, and its port must be publicly reachable. This issue is fixed in Asterisk 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00602.

Exploitation none

Automatable yes

Technical Impact partial

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
asterisk asterisk affected
Version Status Constraints
>= 21.0.0-pre1, < 21.12.3 affected —
>= 22.0.0-pre1, < 22.10.1 affected —
>= 23.0.0-pre1, < 23.4.1 affected —
asterisk certified-asterisk affected
Version Status Constraints
>= 22.8-cert1-pre1, < 22.8-cert3 affected —

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors Products
Asterisk Subscribe
Asterisk Subscribe
Certified Asterisk Subscribe

Project Subscriptions

Vendors Products
Asterisk Subscribe
Asterisk Subscribe
Certified Asterisk Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://github.com/asterisk/asterisk/commit/07b9740cbc371ffa7936cf368089fd073250ea7c cve-icon cve-icon
https://github.com/asterisk/asterisk/commit/0e776a837106d5d0d14503a53388337931045164 cve-icon cve-icon
https://github.com/asterisk/asterisk/commit/42d3552d2ac0efbb68c9ec7ade898b6de0bfa033 cve-icon cve-icon
https://github.com/asterisk/asterisk/commit/46c6c652d1de9bfbb061fab0b1f681cf60660998 cve-icon cve-icon
https://github.com/asterisk/asterisk/commit/62a7a7037b1a145cabf95895b119cbae4d3c5a4f cve-icon cve-icon
https://github.com/asterisk/asterisk/releases/tag/21.12.3 cve-icon cve-icon
https://github.com/asterisk/asterisk/releases/tag/22.10.1 cve-icon cve-icon
https://github.com/asterisk/asterisk/releases/tag/23.4.1 cve-icon cve-icon
https://github.com/asterisk/asterisk/releases/tag/certified-22.8-cert3 cve-icon cve-icon
https://github.com/asterisk/asterisk/security/advisories/GHSA-h5hv-jmgj-92q2 cve-icon cve-icon
https://github.com/asterisk/asterisk/tree/24.0.0-pre1 cve-icon cve-icon
History

Wed, 28 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 27 Oct 2026 23:00:00 +0000

Type Values Removed Values Added
First Time appeared Asterisk
Asterisk asterisk
Asterisk certified Asterisk
Vendors & Products Asterisk
Asterisk asterisk
Asterisk certified Asterisk

Tue, 27 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Asterisk is an open source private branch exchange and telephony toolkit. From 21.0.0-pre1 until Asterisk 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3, the `chan_ooh323` `Q.931 party-number parser` lacks the `CVE-2022-37325` fix because that fix was never forward-ported from Asterisk 20 to later versions. Malformed Q.931 elements in an `OOH323 request` can therefore crash Asterisk. This issue affects Asterisk versions greater than 20. The `chan_ooh323` addon channel driver must be explicitly compiled and installed, which is not the default, and its port must be publicly reachable. This issue is fixed in Asterisk 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3.
Title Asterisk: CVE-2022-37325 fix is absent from current chan_ooh323 Q.931 party-number parser
Weaknesses CWE-839
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-28T16:13:12.086Z

Reserved: 2026-06-24T01:47:55.287Z

Link: CVE-2026-57186

cve-icon Vulnrichment

Updated: 2026-10-28T15:54:29.698Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-27T22:17:26.990

Modified: 2026-10-28T17:18:31.280

Link: CVE-2026-57186

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-27T23:00:16Z

Weaknesses