Description
Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 18.26.4 and 18.9-cert17, RTP UDP ports and internal resources can leak due to a lack of session termination. This could result in leaks and resource exhaustion. This issue has been patched in versions 18.26.4 and 18.9-cert17.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| asterisk | asterisk | < 18.26.4, < 18.9-cert17 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | asterisk | 1:22.2.0~dfsg+~cs6.15.60671435-1 | — |
| Debian 11 | asterisk | 1:16.28.0~dfsg-0+deb11u8 | DLA-4326-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | asterisk | No fix yet | — |
| Ubuntu 22.04 LTS | asterisk | No fix yet | — |
| Ubuntu 20.04 LTS | asterisk | No fix yet | — |
| Ubuntu 18.04 LTS | asterisk | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | asterisk | No fix yet | — |
Advisories 2
- WID-SEC-2025-1926 Asterisk: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Apr 12, 2026
- DLA-4326-1 asterisk - security update Debian Security (DSA / DLA) · Oct 10, 2025
References
- https://github.com/asterisk/asterisk/security/advisories/GHSA-557q-795j-wfx2
- https://github.com/asterisk/asterisk/pull/1405
- https://github.com/asterisk/asterisk/pull/1406
- https://github.com/asterisk/asterisk/commit/0278f5bde14565c6838a6ec39bc21aee0cde56a9
- https://github.com/asterisk/asterisk/commit/eafcd7a451dcd007dddf324ac37dd55a4808338d