CVE-2025-54995 in Asterisk
Summary
by MITRE • 08/28/2025
Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 18.26.4 and 18.9-cert17, RTP UDP ports and internal resources can leak due to a lack of session termination. This could result in leaks and resource exhaustion. This issue has been patched in versions 18.26.4 and 18.9-cert17.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 01/26/2026
The vulnerability identified as CVE-2025-54995 affects Asterisk, a widely used open source private branch exchange and telephony toolkit that serves as the foundation for voice over internet protocol communications in enterprise and telecommunications environments. This critical flaw resides in the session management mechanisms of the Asterisk application, specifically within its handling of Real-time Transport Protocol UDP ports and internal resource allocation. The issue manifests when sessions fail to terminate properly, creating a resource leak condition that can accumulate over time and ultimately lead to system instability or complete service disruption.
The technical root cause of this vulnerability stems from inadequate session cleanup procedures within Asterisk's RTP handling code. When telephony sessions are established and subsequently terminated, the system should release all associated UDP ports and internal resources back to the operating system for reuse. However, in affected versions, the session termination process fails to properly clean up these resources, resulting in what is known as a resource leak. This condition is particularly concerning in high-traffic telephony environments where thousands of concurrent sessions may be active, as each failed termination contributes to progressive resource exhaustion.
The operational impact of this vulnerability extends beyond simple resource consumption, creating potential denial of service conditions that can severely disrupt telephony services. Attackers could exploit this weakness by initiating numerous sessions that are not properly terminated, gradually consuming available UDP port ranges and internal memory resources until the system becomes unresponsive or crashes. This type of resource exhaustion attack represents a significant threat to telephony infrastructure, particularly in environments where Asterisk serves as a core communication platform for business operations. The vulnerability affects both the 18.26.x release line and the 18.9-cert17 release, indicating a widespread issue across multiple supported versions of the software.
From a cybersecurity perspective, this vulnerability aligns with CWE-404, which describes improper resource release or cleanup, and represents a classic example of how session management failures can create persistent security weaknesses. The ATT&CK framework categorizes this as a resource exhaustion technique, where adversaries systematically consume system resources to deny service to legitimate users. Organizations running Asterisk systems should prioritize immediate patching to versions 18.26.4 and 18.9-cert17, as these releases contain the necessary fixes to properly terminate sessions and prevent resource leakage. Additionally, system administrators should implement monitoring solutions to detect unusual resource consumption patterns that might indicate exploitation attempts, while also establishing baseline performance metrics to quickly identify when systems begin to experience resource constraints. The vulnerability serves as a reminder of the critical importance of proper session management in telephony systems and the potential for seemingly minor resource management flaws to create significant operational and security impacts.