CVE-2026-57186
Description
A flaw was found in Asterisk. The Q.931 party-number parser within the chan_ooh323 channel driver fails to properly validate incoming data. A remote, unauthenticated attacker can exploit this flaw by sending malformed Q.931 elements in an OOH323 request, causing the application to crash and resulting in a denial of service (DoS).
Statement
Red Hat Product Security rates this vulnerability as Important because an unauthenticated remote attacker can crash the telephony service, causing a complete denial of service without requiring user interaction. Asterisk is not included or supported in Red Hat Enterprise Linux. In environments where Asterisk is deployed, the vulnerable chan_ooh323 channel driver is an optional add-on that is neither compiled nor loaded by default, and exploitation is only possible if the service port is reachable from untrusted networks.
Mitigation
--- CME Mitigation Guidance (2026-11-03) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to enforce lower-bound length checks on incoming Q.931 information elements in chan_ooh323 before performing memcpy buffer calculations: upgrade to Asterisk 21.12.3, 22.10.1, 23.4.1, Certified Asterisk 22.8-cert3 (or the fixed Asterisk builds), which verify that ie->length is at least equal to numoffset for calling party numbers and at least 1 for called party numbers before copying memory, rejecting invalid elements with an error log, closing all 2 injection vectors (malformed Q.931 calling party number element, malformed Q.931 called party number element). Until patched, this is a concern on Asterisk installations running the optional chan_ooh323 add-on channel driver with reachable OOH323 listening ports, so Unload the chan_ooh323 channel driver if not strictly required, or restrict network access to the Asterisk OOH323 listening port so it cannot be reached by untrusted traffic. These controls limit blast radius and contain exploitation, but they do not fix the underlying integer underflow defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-1311 Input Size and Quantity Bounds Enforcement (high)
Understanding the Weakness (CWE)
Other
Technical Impact: Varies by Context
When untrusted input is not properly validated for the expected syntax, attackers could cause parsing failures, trigger unexpected errors, or expose latent vulnerabilities that might not be directly exploitable if the input had conformed to the syntax.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
