What’s Vulnerable › Vulnerabilities

CVE-2025-54995: Asterisk remotely exploitable leak of RTP UDP ports and internal resources

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-08-28 · updated 2026-06-17
• Weakness: CWE-400

Description

Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 18.26.4 and 18.9-cert17, RTP UDP ports and internal resources can leak due to a lack of session termination. This could result in leaks and resource exhaustion. This issue has been patched in versions 18.26.4 and 18.9-cert17.

Affected products

• asterisk: before 18.26.4 — fixed in 18.26.4
• Sangoma Certified Asterisk: before 18.9; 18.9-cert1, 18.9-cert1-rc1, 18.9-cert10, 18.9-cert11, 18.9-cert12, 18.9-cert13 (+13) — fixed in 18.9

How to fix

Upgrade to a fixed version: asterisk 18.26.4; Sangoma Certified Asterisk 18.9. Check the vendor advisory for mitigations.

References

• https://github.com/asterisk/asterisk/commit/0278f5bde14565c6838a6ec39bc21aee0cde56a9
• https://github.com/asterisk/asterisk/commit/eafcd7a451dcd007dddf324ac37dd55a4808338d
• https://github.com/asterisk/asterisk/pull/1405
• https://github.com/asterisk/asterisk/pull/1406
• https://github.com/asterisk/asterisk/security/advisories/GHSA-557q-795j-wfx2
• https://lists.debian.org/debian-lts-announce/2025/10/msg00006.html

Get alerted when CVE-2025-54995 or the next vulnerability affects your stack