CVE-2026-9754

FreeSWITCH prior to version 1.11.1 has a heap overflow vulnerability in the mod_verto module. An attacker can send an HTTP POST request with a large body, causing a buffer overflow before authentication.

In FreeSWITCH prior to version 1.11.1, esl_recv_event() mishandles Content-Length, allowing a malicious ESL peer to send a frame with a negative value, causing heap corruption or process crash before authentication.

Vulnerability in FreeSWITCH before version 1.11.1 in mod_verto's check_auth userauth branch writes request-supplied userVariables into the connection state before password comparison. Writes are append-only and the connection is not closed on failed compare, so values from bad-password attempts persist on the same WebSocket and carry into a subsequent successful login.

Stack overflow vulnerability in FreeSWITCH before version 1.11.1. A single unauthenticated WebSocket frame with a deeply nested JSON document crashes the FreeSWITCH process, terminating all calls and sessions on the host.

FreeSWITCH before version 1.11.1 has a vulnerability in mod_verto. The JSON-RPC handler binds the connection to the client-supplied sessid before the authentication gate. An unauthenticated attacker who knows a target session UUID can evict the legitimate client by sending it a verto.punt and closing its socket.

Vulnerability in FreeSWITCH before version 1.11.1. The mod_verto's WebSocket frame loop intercepts a #-prefixed speed-test protocol (#SPU / #SPB / #SPE) before any authentication check. The declared payload size in #SPU was parsed with atoi() and only rejected non-positive values, so an unauthenticated peer could request up to INT_MAX bytes. The server then wrote roughly size * 10 bytes back during the download phase, on the order of 20 GB per request, yielding strong outbound bandwidth amplification from a short request.

FreeSWITCH prior to version 1.11.0 has a flaw in STUN packet handling where a declared attribute length shorter than the structure causes out-of-bounds memory access on the media buffer.

FreeSWITCH prior to version 1.11.0 includes a vulnerable function PREFIX(prologTok)() in libs/xmlrpc-c/lib/expat/xmltok/xmltok_impl.c, which was cloned from an outdated and vulnerable version in libexpat/libexpat. The function did not receive the corresponding security patch. This issue has been patched in version 1.11.0.

FreeSWITCH prior to version 1.11.0 has a vulnerability in its bundled XML parser that expands nested <!ENTITY> declarations without depth or count limits, enabling a "billion laughs" attack. An unauthenticated network attacker can send a single SIP PUBLISH request with a PIDF body that, before any digest check, causes unbounded CPU and memory consumption.