CVE-2014-9374: Double free vulnerability in the WebSocket Server (res_http_websocket module) in Asterisk Open Source 11.x...

Security readout for executives and security teams

This is a remote crash flaw in Asterisk's WebSocket server module. An attacker who can reach the WebSocket interface on affected versions could crash the service, disrupting voice or communications availability. The sources do not indicate data theft, privilege escalation, or confirmed active exploitation. Exposure is most likely where affected Asterisk versions run the WebSocket server module and the interface is reachable by untrusted networks. Internal-only deployments still carry operational risk if attackers or compromised hosts can reach that service. Prioritize remediation for internet-facing or business-critical Asterisk systems because the confirmed impact is service crash. Lower priority may be reasonable for patched, isolated, or non-WebSocket deployments, but evidence is incomplete without local configuration validation. Mitigation focus: Upgrade Asterisk to the fixed versions named in the advisory.; Apply relevant distribution security updates from Mageia or Mandriva if used.; Review Asterisk vendor guidance for any deployment-specific workarounds..

Prepared

Jun 14, 2026, 05:41 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.