CVE-2025-54995 Asterisk remotely exploitable leak of RTP UDP ports and internal resources
Attackers can cause resource exhaustion and service disruption in Asterisk by exploiting a lack of session termination for RTP UDP ports.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-54995?
CVE-2025-54995 is a medium-severity denial of service vulnerability in asterisk, published on 28 Aug 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 18.26.4 and 18.9-cert17, RTP UDP ports and internal resources can leak due to a lack of session termination. This could result in leaks and resource exhaustion. This issue has been patched in versions 18.26.4 and 18.9-cert17.
Which versions are affected by CVE-2025-54995?
It affects 2 products.
Products include Sangoma Asterisk, Sangoma Certified Asterisk.
How do I fix CVE-2025-54995?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-54995 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-54995 exists.
Other vulnerabilities in asterisk
- CVE-2024-57520 Path traversal in n/a
- CVE-2025-47779 Using malformed From header can forge identity with ";" or NULL in name portion
- CVE-2025-57767 Asterisk can crash from a specifically malformed Authorization header in an incoming SIP request
- CVE-2022-37325 Memory corruption in n/a
- CVE-2025-1131 Asterisk Unsafe Shell Sourcing in safe_asterisk Leads to Local Privilege Escalation
Sources
Also known as DEBIAN-CVE-2025-54995, GHSA-557q-795j-wfx2, UBUNTU-CVE-2025-54995.