CVE-2026-49475
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
FreeSWITCH prior to version 1.11.0 has a flaw in STUN packet handling where a declared attribute length shorter than the structure causes out-of-bounds memory access on the media buffer.
Risk Assessment
The vulnerability could allow a remote attacker to execute code or cause a system crash by sending a crafted STUN packet.
Recommendation
Update FreeSWITCH to version 1.11.0 or later, which includes the fix.
Other vulnerabilities in FreeSWITCH
See all- CVE-2026-49841Critical
FreeSWITCH prior to version 1.11.1 has a heap overflow vulnerability in the mod_verto module. An attacker can send an HTTP POST request with a large body, causing a buffer overflow before authentication.
- CVE-2026-49840Critical
In FreeSWITCH prior to version 1.11.1, esl_recv_event() mishandles Content-Length, allowing a malicious ESL peer to send a frame with a negative value, causing heap corruption or process crash before authentication.
- CVE-2026-9754Medium
An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted issuances of the filemd5 command.
- CVE-2026-49848Medium
Vulnerability in FreeSWITCH before version 1.11.1 in mod_verto's check_auth userauth branch writes request-supplied userVariables into the connection state before password comparison. Writes are append-only and the connection is not closed on failed compare, so values from bad-password attempts persist on the same WebSocket and carry into a subsequent successful login.
- CVE-2026-49847High
Stack overflow vulnerability in FreeSWITCH before version 1.11.1. A single unauthenticated WebSocket frame with a deeply nested JSON document crashes the FreeSWITCH process, terminating all calls and sessions on the host.
- CVE-2026-49843Medium
FreeSWITCH before version 1.11.1 has a vulnerability in mod_verto. The JSON-RPC handler binds the connection to the client-supplied sessid before the authentication gate. An unauthenticated attacker who knows a target session UUID can evict the legitimate client by sending it a verto.punt and closing its socket.
- CVE-2026-49842High
Vulnerability in FreeSWITCH before version 1.11.1. The mod_verto's WebSocket frame loop intercepts a #-prefixed speed-test protocol (#SPU / #SPB / #SPE) before any authentication check. The declared payload size in #SPU was parsed with atoi() and only rejected non-positive values, so an unauthenticated peer could request up to INT_MAX bytes. The server then wrote roughly size * 10 bytes back during the download phase, on the order of 20 GB per request, yielding strong outbound bandwidth amplification from a short request.
- CVE-2026-49472Medium
FreeSWITCH prior to version 1.11.0 includes a vulnerable function PREFIX(prologTok)() in libs/xmlrpc-c/lib/expat/xmltok/xmltok_impl.c, which was cloned from an outdated and vulnerable version in libexpat/libexpat. The function did not receive the corresponding security patch. This issue has been patched in version 1.11.0.
- CVE-2026-45771High
FreeSWITCH prior to version 1.11.0 has a vulnerability in its bundled XML parser that expands nested <!ENTITY> declarations without depth or count limits, enabling a "billion laughs" attack. An unauthenticated network attacker can send a single SIP PUBLISH request with a PIDF body that, before any digest check, causes unbounded CPU and memory consumption.
Original NVD description (English source)
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.11.0, a STUN packet whose declared attribute length is shorter than the structure the parser casts to causes the parser to read and write past the end of the attribute, producing an out-of-bounds memory access on the per-leg media buffer. This issue has been patched in version 1.11.0.