CVE-2025-54995
published 2025-08-28CVE-2025-54995: Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 18.26.4 and 18.9-cert17, RTP UDP ports and internal resources can…
PriorityP335medium6.5CVSS 3.1
AVNACLPRLUINSUCNINAH
EPSS
0.45%
35.8th percentile
Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 18.26.4 and 18.9-cert17, RTP UDP ports and internal resources can leak due to a lack of session termination. This could result in leaks and resource exhaustion. This issue has been patched in versions 18.26.4 and 18.9-cert17.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| asterisk | asterisk | < 18.26.4 | 18.26.4 |
| asterisk | asterisk | < 18.9-cert17 | 18.9-cert17 |
| asterisk | asterisk | >= 0 < 1:16.28.0~dfsg-0+deb11u8 | 1:16.28.0~dfsg-0+deb11u8 |
| debian | asterisk | < asterisk 1:16.28.0~dfsg-0+deb11u8 (bullseye) | asterisk 1:16.28.0~dfsg-0+deb11u8 (bullseye) |
| sangoma | asterisk | < 18.26.4 | 18.26.4 |
| sangoma | certified_asterisk | < 18.9 | 18.9 |
| sangoma | certified_asterisk | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv6.5MEDIUM
vendor_debian6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Debian
CVE-2025-54995: asterisk - Asterisk is an open source private branch exchange and telephony toolkit. Prior ...
vendor_debian·2025·CVSS 6.5
CVE-2025-54995 [MEDIUM] CVE-2025-54995: asterisk - Asterisk is an open source private branch exchange and telephony toolkit. Prior ...
Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 18.26.4 and 18.9-cert17, RTP UDP ports and internal resources can leak due to a lack of session termination. This could result in leaks and resource exhaustion. This issue has been patched in versions 18.26.4 and 18.9-cert17.
Scope: local
bullseye: resolved (fixed in 1:16.28.0~dfsg-0+deb11u8)
sid: resolved (fixed in 1:22.2.0~dfsg+~cs6.15.60671435-1)
OSV
CVE-2025-54995: Asterisk is an open source private branch exchange and telephony toolkit
osv·2025-08-28·CVSS 6.5
CVE-2025-54995 [MEDIUM] CVE-2025-54995: Asterisk is an open source private branch exchange and telephony toolkit
Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 18.26.4 and 18.9-cert17, RTP UDP ports and internal resources can leak due to a lack of session termination. This could result in leaks and resource exhaustion. This issue has been patched in versions 18.26.4 and 18.9-cert17.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2025-54995 asterisk: Asterisk resource exhaustion [fedora-41]
bugzilla·2025-08-28·CVSS 6.5
CVE-2025-54995 [MEDIUM] CVE-2025-54995 asterisk: Asterisk resource exhaustion [fedora-41]
CVE-2025-54995 asterisk: Asterisk resource exhaustion [fedora-41]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
Discussion:
This message is a reminder that Fedora Linux 41 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 41 on 2025-12-15.
It is Fedora's policy to close all bug reports from releases
Bugzilla
CVE-2025-54995 asterisk: Asterisk resource exhaustion [epel-8]
bugzilla·2025-08-28·CVSS 6.5
CVE-2025-54995 [MEDIUM] CVE-2025-54995 asterisk: Asterisk resource exhaustion [epel-8]
CVE-2025-54995 asterisk: Asterisk resource exhaustion [epel-8]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
Discussion:
The issue (CVE-2025-54995) is addressed in Asterisk version 18.26.4. The fix is now available via the asterisk-18.26.4 update for EPEL 8 and EPEL 9.
---
FEDORA-EPEL-2026-f2281acb03 (asterisk-18.26.4-1.el8) has been submitt
Bugzilla
CVE-2025-54995 asterisk: Asterisk resource exhaustion [fedora-42]
bugzilla·2025-08-28·CVSS 6.5
CVE-2025-54995 [MEDIUM] CVE-2025-54995 asterisk: Asterisk resource exhaustion [fedora-42]
CVE-2025-54995 asterisk: Asterisk resource exhaustion [fedora-42]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
Discussion:
The issue (CVE-2025-54995) is addressed in Asterisk version 18.26.4. The fix is now available via the asterisk-18.26.4 update for f42/f43/f44.
---
FEDORA-2026-98decbde87 (asterisk-18.26.4-1.fc42) has been submitted as a
Bugzilla
CVE-2025-54995 asterisk: Asterisk resource exhaustion [epel-9]
bugzilla·2025-08-28·CVSS 6.5
CVE-2025-54995 [MEDIUM] CVE-2025-54995 asterisk: Asterisk resource exhaustion [epel-9]
CVE-2025-54995 asterisk: Asterisk resource exhaustion [epel-9]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
Discussion:
The issue (CVE-2025-54995) is addressed in Asterisk version 18.26.4. The fix is now available via the asterisk-18.26.4 update for EPEL 8 and EPEL 9.
---
FEDORA-EPEL-2026-f2281acb03 (asterisk-18.26.4-1.el8) has been submitt
https://github.com/asterisk/asterisk/commit/0278f5bde14565c6838a6ec39bc21aee0cde56a9https://github.com/asterisk/asterisk/commit/eafcd7a451dcd007dddf324ac37dd55a4808338dhttps://github.com/asterisk/asterisk/pull/1405https://github.com/asterisk/asterisk/pull/1406https://github.com/asterisk/asterisk/security/advisories/GHSA-557q-795j-wfx2https://lists.debian.org/debian-lts-announce/2025/10/msg00006.html
2025-08-28
Published