# CVE-2026-57186: Asterisk OOH323 Q.931 parser denial of service

Source: https://junglewise.ai/threats/cve-2026-57186-asterisk-is-an-open-source-private-branch-exchange-and-telephony  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-27. Updated: 2026-10-27  
License: CC BY 4.0 with a link back

CVE-2026-57186 · Severity: high · CVSS 7.5 · Published 2026-10-27

Asterisk is an open-source PBX and VoIP telephony platform used to route voice calls and messages. The optional OOH323 channel driver fails to validate the length of Q.931 protocol elements, allowing a remote attacker to crash the Asterisk service by sending a specially crafted call request. This affects only installations that have explicitly compiled and enabled the OOH323 addon with a publicly reachable port.

Technologies: [Asterisk](https://junglewise.ai/threats/technologies/asterisk), [Asterisk Certified Asterisk](https://junglewise.ai/threats/technologies/certified-asterisk). Vendors: [Asterisk](https://junglewise.ai/threats/vendors/asterisk).

## Quick answers

**Is CVE-2026-57186 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-57186 being exploited in the wild.

**How severe is CVE-2026-57186?** High severity, with a CVSS score of 7.5, published 27 October 2026.

**Which products and versions are affected?** Asterisk 21.0.0-pre1 to 21.12.2, 22.0.0 to 22.10.0, 23.0.0 to 23.4.0; Asterisk Certified Asterisk 22.0-cert to 22.8-cert2.

**Is there a fix for CVE-2026-57186?** Yes: fixed in Asterisk 21.12.3, 22.10.1, 23.4.1; Certified Asterisk 22.8-cert3. Until then: The chan_ooh323 addon must be explicitly compiled and is not enabled by default; deployments not using OOH323 are unaffected. For affected deployments, restrict network access to the OOH323 port or disable the chan_ooh323 module until patching is possible. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-57186 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-57186?** Check whether you run Asterisk or Asterisk Certified Asterisk at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Asterisk 21.12.3, 22.10.1, 23.4.1; Certified Asterisk 22.8-cert3

The chan_ooh323 addon must be explicitly compiled and is not enabled by default; deployments not using OOH323 are unaffected. For affected deployments, restrict network access to the OOH323 port or disable the chan_ooh323 module until patching is possible.

## Technical details

The chan_ooh323 Q.931 party-number parser lacks minimum length validation for calling/called number information elements (IE), allowing malformed Q.931 elements in OOH323 requests to trigger a buffer overflow or out-of-bounds access and crash Asterisk. The vulnerability exists because a prior CVE-2022-37325 fix was never forward-ported from Asterisk 20 to later versions. The attack requires network access to the OOH323 port and does not require authentication.

## Affected products

- Asterisk Asterisk 21.0.0-pre1 to 21.12.2, 22.0.0 to 22.10.0, 23.0.0 to 23.4.0
- Asterisk Certified Asterisk 22.0-cert to 22.8-cert2

## Timeline

- 2026-10-27: disclosed

## References

- [https://github.com/asterisk/asterisk/commit/07b9740cbc371ffa7936cf368089fd073250ea7c](https://github.com/asterisk/asterisk/commit/07b9740cbc371ffa7936cf368089fd073250ea7c)
- [https://github.com/asterisk/asterisk/commit/0e776a837106d5d0d14503a53388337931045164](https://github.com/asterisk/asterisk/commit/0e776a837106d5d0d14503a53388337931045164)

## Related threats

- [Asterisk privilege escalation in ast_loggrabber via /tmp](https://junglewise.ai/threats/cve-2026-57203-asterisk-is-an-open-source-private-branch-exchange-and-telephony)
- [Asterisk authorization bypass in ARI REST-over-WebSocket](https://junglewise.ai/threats/cve-2026-57200-asterisk-is-an-open-source-private-branch-exchange-and-telephony)
- [Asterisk NULL pointer dereference in Manager Interface HTTP digest authentication](https://junglewise.ai/threats/cve-2026-57195-asterisk-is-an-open-source-private-branch-exchange-and-telephony)
- [Asterisk privilege escalation in REST Interface](https://junglewise.ai/threats/cve-2026-57202-asterisk-is-an-open-source-private-branch-exchange-and-telephony)
- [Asterisk stack buffer overflow in XMPP namespace prefix handling](https://junglewise.ai/threats/cve-2026-57188-asterisk-is-an-open-source-private-branch-exchange-and-telephony)