CVE-2025-54995

NameCVE-2025-54995
DescriptionAsterisk is an open source private branch exchange and telephony toolkit. Prior to versions 18.26.4 and 18.9-cert17, RTP UDP ports and internal resources can leak due to a lack of session termination. This could result in leaks and resource exhaustion. This issue has been patched in versions 18.26.4 and 18.9-cert17.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-4326-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
asterisk (PTS)forky, sid1:22.10.1+dfsg+~cs6.17.60671434-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
asterisksourcebullseye1:16.28.0~dfsg-0+deb11u8DLA-4326-1
asterisksource(unstable)1:22.2.0~dfsg+~cs6.15.60671435-1

Notes

https://github.com/asterisk/asterisk/security/advisories/GHSA-557q-795j-wfx2
https://github.com/asterisk/asterisk/pull/1405
https://github.com/asterisk/asterisk/commit/eafcd7a451dcd007dddf324ac37dd55a4808338d
1:22.2.0~dfsg+~cs6.15.60671435-1 is the first version in unstable updating
the bundled pjproject to 2.15.1.
Search for package or bug name: Reporting problems