By vendor

Freeswitch vulnerabilities

Known CVEs affecting Freeswitch products, prioritized by severity, with SEC.co remediation and detection guidance.

7 published vulnerabilities

• CVE-2026-45771HIGH 7.5

  FreeSWITCH versions before 1.11.0 contain a denial-of-service vulnerability in their XML parser that allows an unauthenticated attacker to crash or severely degrade the system by sending a specially crafted SIP message. The attack exploits a classic "billion laughs" XML expansion flaw, where nested entity definitions cause exponential memory and CPU consumption. Because the malicious payload is processed before authentication checks, an attacker on the network can trigger the vulnerability without credentials—a single request is enough to cause significant resource exhaustion.

• CVE-2026-49475HIGH 7.5

  FreeSWITCH, a popular open-source telecom platform used to build VoIP and communication systems, contains a flaw in how it processes STUN packets—a protocol used for network address translation and firewall traversal in voice communications. An attacker sending a specially crafted STUN packet with a mismatched attribute length can cause the software to read and write beyond allocated memory buffers. This out-of-bounds memory access occurs in the media buffer handling logic and can crash the affected FreeSWITCH instance, disrupting voice and video services. The vulnerability affects all versions prior to 1.11.0.

• CVE-2026-49842HIGH 7.5

  FreeSWITCH, an open-source telecom platform, contains a flaw in its WebSocket handling that allows unauthenticated attackers to trigger massive outbound data transfers. An attacker can send a specially crafted speed-test protocol message that causes the server to send back approximately 20 GB of data per request, effectively amplifying a small request into a large bandwidth-consuming response. This vulnerability exists before patching and requires no authentication or user interaction—any network-connected FreeSWITCH instance is at risk.

• CVE-2026-49847HIGH 7.5

  FreeSWITCH versions prior to 1.11.1 are vulnerable to a denial-of-service attack that can be triggered by sending a specially crafted WebSocket message containing deeply nested JSON data. An attacker requires no authentication and can crash the entire FreeSWITCH process from the network, immediately terminating all active calls and sessions on the affected host. The vulnerability exploits improper recursion handling in JSON parsing, causing a stack overflow that the kernel stops before any memory corruption can be weaponized.

• CVE-2026-49472MEDIUM 5.3

  FreeSWITCH versions prior to 1.11.0 contain a flaw in their embedded XML parsing library that can cause the application to stop responding to requests. The vulnerability stems from code that was copied from an older, unpatched version of libexpat and never received the security fix that libexpat itself received. An authenticated user with local or network access could trigger this denial-of-service condition, though the attack requires specific conditions to succeed.

• CVE-2026-49843MEDIUM 5.3

  FreeSWITCH versions before 1.11.1 contain a session hijacking vulnerability in the mod_verto JSON-RPC handler. An unauthenticated attacker with knowledge of a legitimate user's session ID can forcibly disconnect that user by claiming the same session identifier, causing the legitimate connection to be dropped and any active calls to be terminated. The vulnerability stems from the application binding incoming connections to user-supplied session IDs before verifying authentication credentials.

• CVE-2026-49848MEDIUM 4.3

  FreeSWITCH versions prior to 1.11.1 contain a flaw in the Verto module's authentication handler that allows user-supplied session variables to be written into connection state before password validation occurs. Because these writes are append-only and failed authentication attempts don't close the WebSocket connection, variables from a bad login attempt persist and carry over into a subsequent successful login on the same connection. This creates a window for session state manipulation through repeated authentication attempts.