CVE-2026-49843
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
FreeSWITCH before version 1.11.1 has a vulnerability in mod_verto. The JSON-RPC handler binds the connection to the client-supplied sessid before the authentication gate. An unauthenticated attacker who knows a target session UUID can evict the legitimate client by sending it a verto.punt and closing its socket.
Risk Assessment
An attacker can disrupt legitimate users' connections, causing denial of service and potential call disconnection.
Recommendation
Update FreeSWITCH to version 1.11.1 or later, which includes a fix enforcing authentication before session binding.
Other vulnerabilities in FreeSWITCH
See all- CVE-2026-49841Critical
FreeSWITCH prior to version 1.11.1 has a heap overflow vulnerability in the mod_verto module. An attacker can send an HTTP POST request with a large body, causing a buffer overflow before authentication.
- CVE-2026-49840Critical
In FreeSWITCH prior to version 1.11.1, esl_recv_event() mishandles Content-Length, allowing a malicious ESL peer to send a frame with a negative value, causing heap corruption or process crash before authentication.
- CVE-2026-9754Medium
An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted issuances of the filemd5 command.
- CVE-2026-49848Medium
Vulnerability in FreeSWITCH before version 1.11.1 in mod_verto's check_auth userauth branch writes request-supplied userVariables into the connection state before password comparison. Writes are append-only and the connection is not closed on failed compare, so values from bad-password attempts persist on the same WebSocket and carry into a subsequent successful login.
- CVE-2026-49847High
Stack overflow vulnerability in FreeSWITCH before version 1.11.1. A single unauthenticated WebSocket frame with a deeply nested JSON document crashes the FreeSWITCH process, terminating all calls and sessions on the host.
- CVE-2026-49842High
Vulnerability in FreeSWITCH before version 1.11.1. The mod_verto's WebSocket frame loop intercepts a #-prefixed speed-test protocol (#SPU / #SPB / #SPE) before any authentication check. The declared payload size in #SPU was parsed with atoi() and only rejected non-positive values, so an unauthenticated peer could request up to INT_MAX bytes. The server then wrote roughly size * 10 bytes back during the download phase, on the order of 20 GB per request, yielding strong outbound bandwidth amplification from a short request.
- CVE-2026-49475High
FreeSWITCH prior to version 1.11.0 has a flaw in STUN packet handling where a declared attribute length shorter than the structure causes out-of-bounds memory access on the media buffer.
- CVE-2026-49472Medium
FreeSWITCH prior to version 1.11.0 includes a vulnerable function PREFIX(prologTok)() in libs/xmlrpc-c/lib/expat/xmltok/xmltok_impl.c, which was cloned from an outdated and vulnerable version in libexpat/libexpat. The function did not receive the corresponding security patch. This issue has been patched in version 1.11.0.
- CVE-2026-45771High
FreeSWITCH prior to version 1.11.0 has a vulnerability in its bundled XML parser that expands nested <!ENTITY> declarations without depth or count limits, enabling a "billion laughs" attack. An unauthenticated network attacker can send a single SIP PUBLISH request with a PIDF body that, before any digest check, causes unbounded CPU and memory consumption.
Original NVD description (English source)
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.11.1, mod_verto's JSON-RPC handler bound the connection to the client-supplied sessid on the first frame, before the authentication gate. Binding inserts the connection into the global session hash and, on a key collision, drops the prior occupant of that slot — sending it a verto.punt, detaching its calls, and closing its socket. An unauthenticated network attacker who knows a target session UUID could therefore evict the legitimate client. This issue has been patched in version 1.11.1.