---
id: CVE-2026-57186
title: >-
  Asterisk: CVE-2022-37325 fix is absent from current chan_ooh323 Q.931
  party-number parser
summary: >-
  Asterisk is an open source private branch exchange and telephony toolkit. From
  21.0.0-pre1 until Asterisk 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk
  22.8-cert3, the `chan_ooh323` `Q.931 party-number parser` lacks the
  `CVE-2022-37325…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-839
vendor: asterisk
product: asterisk
affected:
  - 'asterisk >= 21.0.0-pre1, < 21.12.3'
  - 'asterisk >= 22.0.0-pre1, < 22.10.1'
  - 'asterisk >= 23.0.0-pre1, < 23.4.1'
  - 'certified-asterisk >= 22.8-cert1-pre1, < 22.8-cert3'
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-28T15:54:28.501669Z'
published: '2026-10-27'
updated: '2026-10-28'
sourceUpdated: '2026-10-28T16:13:12.086Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-57186'
references:
  - url: >-
      https://github.com/asterisk/asterisk/security/advisories/GHSA-h5hv-jmgj-92q2
    label: >-
      https://github.com/asterisk/asterisk/security/advisories/GHSA-h5hv-jmgj-92q2
  - url: >-
      https://github.com/asterisk/asterisk/commit/07b9740cbc371ffa7936cf368089fd073250ea7c
    label: >-
      https://github.com/asterisk/asterisk/commit/07b9740cbc371ffa7936cf368089fd073250ea7c
  - url: >-
      https://github.com/asterisk/asterisk/commit/0e776a837106d5d0d14503a53388337931045164
    label: >-
      https://github.com/asterisk/asterisk/commit/0e776a837106d5d0d14503a53388337931045164
  - url: >-
      https://github.com/asterisk/asterisk/commit/42d3552d2ac0efbb68c9ec7ade898b6de0bfa033
    label: >-
      https://github.com/asterisk/asterisk/commit/42d3552d2ac0efbb68c9ec7ade898b6de0bfa033
  - url: >-
      https://github.com/asterisk/asterisk/commit/46c6c652d1de9bfbb061fab0b1f681cf60660998
    label: >-
      https://github.com/asterisk/asterisk/commit/46c6c652d1de9bfbb061fab0b1f681cf60660998
  - url: >-
      https://github.com/asterisk/asterisk/commit/62a7a7037b1a145cabf95895b119cbae4d3c5a4f
    label: >-
      https://github.com/asterisk/asterisk/commit/62a7a7037b1a145cabf95895b119cbae4d3c5a4f
  - url: 'https://github.com/asterisk/asterisk/releases/tag/21.12.3'
    label: 'https://github.com/asterisk/asterisk/releases/tag/21.12.3'
  - url: 'https://github.com/asterisk/asterisk/releases/tag/22.10.1'
    label: 'https://github.com/asterisk/asterisk/releases/tag/22.10.1'
  - url: 'https://github.com/asterisk/asterisk/releases/tag/23.4.1'
    label: 'https://github.com/asterisk/asterisk/releases/tag/23.4.1'
  - url: 'https://github.com/asterisk/asterisk/releases/tag/certified-22.8-cert3'
    label: 'https://github.com/asterisk/asterisk/releases/tag/certified-22.8-cert3'
  - url: 'https://github.com/asterisk/asterisk/tree/24.0.0-pre1'
    label: 'https://github.com/asterisk/asterisk/tree/24.0.0-pre1'
tags:
  - cve.org
epss: 0.00602
epssPercentile: 0.48634
ingestedAt: '2026-10-27T21:58:08.880Z'
---

## Overview

Asterisk is an open source private branch exchange and telephony toolkit. From 21.0.0-pre1 until Asterisk 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3, the `chan_ooh323` `Q.931 party-number parser` lacks the `CVE-2022-37325` fix because that fix was never forward-ported from Asterisk 20 to later versions. Malformed Q.931 elements in an `OOH323 request` can therefore crash Asterisk. This issue affects Asterisk versions greater than 20. The `chan_ooh323` addon channel driver must be explicitly compiled and installed, which is not the default, and its port must be publicly reachable. This issue is fixed in Asterisk 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3.

## Affected

- `asterisk >= 21.0.0-pre1, < 21.12.3`
- `asterisk >= 22.0.0-pre1, < 22.10.1`
- `asterisk >= 23.0.0-pre1, < 23.4.1`
- `certified-asterisk >= 22.8-cert1-pre1, < 22.8-cert3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.