Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-57186— Asterisk: CVE-2022-37325 fix is absent from current chan_ooh323 Q.931 party-number parser

Quick assessment

Affected

asterisk asterisk

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Asterisk 是一款开源的专用小交换机（PBX）和电话工具包。在 Asterisk 21.0.0-pre1 至 21.12.3、22.10.1、23.4.1 以及 Certified Asterisk 22.8-cert3 版本中，模块的未包含针对的修复，因为该修复从未从 Asterisk 20 向后移植到后续版本。因此，中畸形的 Q.931 元素可能导致 Asterisk 崩溃。此问题影响所有高于 20 版本的 Asterisk。需要注意的是，附加通道驱动模块必须显式编译并安装（默认情况下未启用），

CVSS 7.5 · High Updated Oct 28, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Asterisk: CVE-2022-37325 fix is absent from current chan_ooh323 Q.931 party-number parser

Source: CVE Program / CVE List V5

Vulnerability Description

Asterisk is an open source private branch exchange and telephony toolkit. From 21.0.0-pre1 until Asterisk 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3, the `chan_ooh323` `Q.931 party-number parser` lacks the `CVE-2022-37325` fix because that fix was never forward-ported from Asterisk 20 to later versions. Malformed Q.931 elements in an `OOH323 request` can therefore crash Asterisk. This issue affects Asterisk versions greater than 20. The `chan_ooh323` addon channel driver must be explicitly compiled and installed, which is not the default, and its port must be publicly reachable. This issue is fixed in Asterisk 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

未进行最小值检查的数值范围比较

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
asterisk	asterisk	>= 21.0.0-pre1, < 21.12.3	-
asterisk	certified-asterisk	>= 22.8-cert1-pre1, < 22.8-cert3	-

II. Public POCs for CVE-2026-57186

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-57186

请登录查看更多情报信息。

Vendor Pages for CVE-2026-57186 (5)

🔗 GitHub - asterisk/asterisk at 24.0.0-pre1 · GitHub x_refsource_MISC
🔗 Release Asterisk Release 23.4.1 · asterisk/asterisk · GitHub x_refsource_MISC
🔗 Release Asterisk Release 21.12.3 · asterisk/asterisk · GitHub x_refsource_MISC
🔗 Release Asterisk Release 22.10.1 · asterisk/asterisk · GitHub x_refsource_MISC
🔗 Release Asterisk Release certified-22.8-cert3 · asterisk/asterisk · GitHub x_refsource_MISC

Other References for CVE-2026-57186 (6)

https://github.com/asterisk/asterisk/security/advisories/GHSA-h5hv-jmgj-92q2 x_refsource_CONFIRM
https://github.com/asterisk/asterisk/commit/0e776a837106d5d0d14503a53388337931045164 x_refsource_MISC
https://github.com/asterisk/asterisk/commit/07b9740cbc371ffa7936cf368089fd073250ea7c x_refsource_MISC
https://github.com/asterisk/asterisk/commit/42d3552d2ac0efbb68c9ec7ade898b6de0bfa033 x_refsource_MISC
https://github.com/asterisk/asterisk/commit/62a7a7037b1a145cabf95895b119cbae4d3c5a4f x_refsource_MISC
https://github.com/asterisk/asterisk/commit/46c6c652d1de9bfbb061fab0b1f681cf60660998 x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-57186

Same Patch Batch · asterisk · 2026-10-27 · 16 CVEs total

CVE-2026-57191	8.2 HIGH	Asterisk: Stack buffer overflow in MWI NOTIFY Message-Account parsing
CVE-2026-57202	8.1 HIGH	Asterisk: ARI setChannelVar bypasses live_dangerously and permits FILE() writes
CVE-2026-57197	7.7 HIGH	Asterisk: Heap Buffer Overflow in OGG/Speex File Playback (format_ogg_speex)
CVE-2026-57201	7.5 HIGH	Asterisk: Stack Buffer Overflow in H.323 ooTrace() via Unbounded vsprintf into Fixed 2048-
CVE-2026-57195	7.5 HIGH	Asterisk: NULL Pointer Dereference in HTTP AMI Digest Authentication
CVE-2026-57200	7.5 HIGH	Asterisk: ARI REST-over-WebSocket read-only bypass allows arbitrary module path load and c
CVE-2026-57188	7.1 HIGH	Asterisk: Stack buffer overflow in res_xmpp XMPP namespace prefix handling
CVE-2026-57190	7.0 HIGH	Asterisk: SQL Injection in cel_pgsql and cel_tds via CELGenUserEvent eventtype Field
CVE-2026-57203	6.9 MEDIUM	Asterisk: Local privilege escalation through ast_loggrabber's world-writable helper locati
CVE-2026-57185	6.5 MEDIUM	Asterisk: Buffer over-read in Asterisk PJSIP MWI body parser
CVE-2026-57192	6.0 MEDIUM	Asterisk: Out-of-Bounds Write in Codec2 Decoder Due to Floor/Ceil Sample Count Mismatch
CVE-2026-57194	5.9 MEDIUM	Asterisk: chan_unistim DIALPAGE digit handling can overflow phone_number and crash Asteris
CVE-2026-57198	2.3 LOW	Asterisk: Possible RED T.140 Heap Buffer Overflow
CVE-2026-57189	2.3 LOW	Asterisk: Possible RED T.140 Generation Accumulation OOB Write
CVE-2026-57199	2.3 LOW	Asterisk: Asterisk app_sms.c copies externally controlled SMS lengths into fixed in-struct

IV. Related Vulnerabilities

Same product: asterisk

Same vendor: asterisk

Same weakness: CWE-839