CVE-2026-49842
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
Vulnerability in FreeSWITCH before version 1.11.1. The mod_verto's WebSocket frame loop intercepts a #-prefixed speed-test protocol (#SPU / #SPB / #SPE) before any authentication check. The declared payload size in #SPU was parsed with atoi() and only rejected non-positive values, so an unauthenticated peer could request up to INT_MAX bytes. The server then wrote roughly size * 10 bytes back during the download phase, on the order of 20 GB per request, yielding strong outbound bandwidth amplification from a short request.
Risk Assessment
The risk involves potential bandwidth amplification attacks, which could lead to network resource exhaustion and denial of service (DoS).
Recommendation
Upgrade to version 1.11.1, which contains the fix for this vulnerability.
Other vulnerabilities in FreeSWITCH
See all- CVE-2026-49841Critical
FreeSWITCH prior to version 1.11.1 has a heap overflow vulnerability in the mod_verto module. An attacker can send an HTTP POST request with a large body, causing a buffer overflow before authentication.
- CVE-2026-49840Critical
In FreeSWITCH prior to version 1.11.1, esl_recv_event() mishandles Content-Length, allowing a malicious ESL peer to send a frame with a negative value, causing heap corruption or process crash before authentication.
- CVE-2026-9754Medium
An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted issuances of the filemd5 command.
- CVE-2026-49848Medium
Vulnerability in FreeSWITCH before version 1.11.1 in mod_verto's check_auth userauth branch writes request-supplied userVariables into the connection state before password comparison. Writes are append-only and the connection is not closed on failed compare, so values from bad-password attempts persist on the same WebSocket and carry into a subsequent successful login.
- CVE-2026-49847High
Stack overflow vulnerability in FreeSWITCH before version 1.11.1. A single unauthenticated WebSocket frame with a deeply nested JSON document crashes the FreeSWITCH process, terminating all calls and sessions on the host.
- CVE-2026-49843Medium
FreeSWITCH before version 1.11.1 has a vulnerability in mod_verto. The JSON-RPC handler binds the connection to the client-supplied sessid before the authentication gate. An unauthenticated attacker who knows a target session UUID can evict the legitimate client by sending it a verto.punt and closing its socket.
- CVE-2026-49475High
FreeSWITCH prior to version 1.11.0 has a flaw in STUN packet handling where a declared attribute length shorter than the structure causes out-of-bounds memory access on the media buffer.
- CVE-2026-49472Medium
FreeSWITCH prior to version 1.11.0 includes a vulnerable function PREFIX(prologTok)() in libs/xmlrpc-c/lib/expat/xmltok/xmltok_impl.c, which was cloned from an outdated and vulnerable version in libexpat/libexpat. The function did not receive the corresponding security patch. This issue has been patched in version 1.11.0.
- CVE-2026-45771High
FreeSWITCH prior to version 1.11.0 has a vulnerability in its bundled XML parser that expands nested <!ENTITY> declarations without depth or count limits, enabling a "billion laughs" attack. An unauthenticated network attacker can send a single SIP PUBLISH request with a PIDF body that, before any digest check, causes unbounded CPU and memory consumption.
Original NVD description (English source)
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.11.1, mod_verto's WebSocket frame loop intercepts a #-prefixed speed-test protocol (#SPU / #SPB / #SPE) before any authentication check. The declared payload size in #SPU was parsed with atoi() and only rejected non-positive values, so an unauthenticated peer could request up to INT_MAX bytes. The server then wrote roughly size * 10 bytes back during the download phase, on the order of 20 GB per request, yielding strong outbound bandwidth amplification from a short request. This issue has been patched in version 1.11.1.