Skip to content
Fencer Intel
high 7.5

CVE-2021-32558 json

An issue was discovered in Sangoma Asterisk 13.x before 13.38.3, 16.x before 16.19.1, 17.x before 17.9.4, and 18.x before 18.5.1, and Certi…

published 5y ago modified 4mo ago also EUVD-2021-19403

cvss
7.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
9.2%
EPSS 9.2% chance of exploitation in 30 days, percentile 95%
public exploits
0
none known

Summary

An issue was discovered in Sangoma Asterisk 13.x before 13.38.3, 16.x before 16.19.1, 17.x before 17.9.4, and 18.x before 18.5.1, and Certified Asterisk before 16.8-cert10. If the IAX2 channel driver receives a packet that contains an unsupported media format, a crash can occur.

Patch / fix

  • digium asterisk 13.38.3, 16.19.1, 17.9.4, 18.15.1
  • asterisk Debian 14 1:16.16.1~dfsg-2

debian advisories DEBIAN-CVE-2021-32558

  • asterisk Alpine 3.11 16.6.2-r1
  • asterisk Alpine 3.12 16.16.1-r1
  • asterisk Alpine 3.13 18.2.1-r2
  • asterisk Alpine 3.24, Alpine 3.23, Alpine 3.22 +8 more 18.2.2-r2

alpine advisories ALPINE-CVE-2021-32558

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Is CVE-2021-32558 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-32558 updated cvss 7.5

asterisk: remote crash when using IAX2 channel driver may lead to DoS

  • Red Hat All currently supported Red Hat products
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

9.22% chance of exploitation in the next 30 days, higher than 95% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • issues.asterisk.org https://issues.asterisk.org/jira/browse/ASTERISK-29392 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:N/I:N/A:P

Classification

Weakness
  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.