CVE-2026-49840
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
In FreeSWITCH prior to version 1.11.1, esl_recv_event() mishandles Content-Length, allowing a malicious ESL peer to send a frame with a negative value, causing heap corruption or process crash before authentication.
Risk Assessment
High risk – the attack can cause service crash or potentially remote code execution in the libesl process.
Recommendation
Upgrade FreeSWITCH to version 1.11.1 or later.
Original NVD description (English source)
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.11.1, esl_recv_event() parses Content-Length with atol() and passes the result straight to malloc(len + 1) with no sign or magnitude check. A malicious or man-in-the-middle ESL peer can send a frame with a negative Content-Length to corrupt the heap of, or crash, any process linked against libesl, before the client has authenticated to that peer. This issue has been patched in version 1.11.1.