CVE-2018-17281
HighThere is a stack consumption vulnerability in the res_http_websocket.so module of Asterisk through 13.23.0, 14.7.x through 14.7.7, and 15.x through 15.6.0 and Certified Asterisk through 13.21-cert2.
Published Sep 24, 2018 · Updated Aug 4, 2026 · Also known as DEBIAN-CVE-2018-17281, DLA-1523-1, UBUNTU-CVE-2018-17281
Key Facts
Patch immediately- CVE-2018-17281 is a high-severity vulnerability (CVSS 7.5 v3.1) affecting Asterisk (Digium), Certified Asterisk (Digium), Debian Linux.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 52% probability of exploitation in the next 30 days.
- Fixed versions are available, including Asterisk 1:11.13.1~dfsg-2+deb8u6, Asterisk 1:13.14.1~dfsg-2+deb9u4, Asterisk 1:13.23.1~dfsg-1.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
7.5
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS (30-day exploit likelihood)
52%
Higher than 98.9% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2018-17281 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
There is a stack consumption vulnerability in the res_http_websocket.so module of Asterisk through 13.23.0, 14.7.x through 14.7.7, and 15.x through 15.6.0 and Certified Asterisk through 13.21-cert2. It allows an attacker to crash Asterisk via a specially crafted HTTP request to upgrade the connection to a websocket.
Affected Products
41 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| AsteriskDigium | See advisory | 14.7.7 |
| Certified AsteriskDigium | 11.6-cert12, 11.6-cert13, 11.6-cert14, 11.6-cert15, 11.6-cert16, 11.6-cert17, 11.6-cert18, 13.13-cert1 | n/a |
| Debian LinuxDebian | 8.0, 9.0 | n/a |
Patched Releases
Asterisk
1:11.13.1~dfsg-2+deb8u6, 1:13.14.1~dfsg-2+deb9u4, 1:13.23.1~dfsg-1, <=13.23.0, <=14.7.7, <=15.6.0
Timeline
Publicly disclosed
Sep 24, 2018
Last updated
Aug 4, 2026
Weakness Type
- CWE-400 Uncontrolled Resource Consumption
References
- advisoryhttp://packetstormsecurity.com/files/149453/Asterisk-Project-Security-Advisory-AST-2018-009.html
- advisoryhttps://downloads.asterisk.org/pub/security/AST-2018-009.html
- advisoryhttps://issues.asterisk.org/jira/browse/ASTERISK-28013
- advisory[debian-lts-announce] 20180927 [SECURITY] [DLA 1523-1] asterisk security update
- advisoryGLSA-201811-11
FAQ
Common Questions.
There is a stack consumption vulnerability in the res_http_websocket.so module of Asterisk through 13.23.0, 14.7.x through 14.7.7, and 15.x through 15.6.0 and Certified Asterisk through 13.21-cert2.
Affected: Asterisk (Digium); Certified Asterisk (Digium) versions 11.6-cert12, 11.6-cert13, 11.6-cert14, 11.6-cert15, 11.6-cert16, 11.6-cert17, 11.6-cert18, 13.13-cert1; Debian Linux versions 8.0, 9.0. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including Asterisk 1:11.13.1~dfsg-2+deb8u6, Asterisk 1:13.14.1~dfsg-2+deb9u4, Asterisk 1:13.23.1~dfsg-1.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2018-17281 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo