CVE-2026-45771: FreeSWITCH XML Billion Laughs DoS – Unauthenticated Remote Denial of Service

Technical summary

The vulnerability stems from FreeSWITCH's bundled XML parser, which recursively expands nested <!ENTITY> declarations in Document Type Definitions (DTDs) without enforcing depth or count limits. When a SIP PUBLISH message containing a PIDF (Presence Information Data Format) body with deeply nested entity definitions reaches the parser, it expands exponentially, consuming unbounded CPU and memory resources. Critically, the PIDF body is parsed before digest authentication validation occurs, allowing network-unauthenticated attackers to trigger the condition. This is a textbook implementation of the "billion laughs" or XML bomb attack pattern (CWE-776: Improper Restriction of Recursive Entity References in DTDs).

Business impact

A successful attack causes immediate denial of service to the FreeSWITCH telecommunications platform. This translates to call handling outages, dropped sessions, and unavailable voice/video services for any organization relying on the affected version. Unlike many DoS vulnerabilities requiring sustained traffic, this exploit can be triggered by a single request, making it trivial to weaponize. Recovery typically requires service restart. For carriers, hosted VoIP providers, and enterprise telephony deployments, even brief outages disrupt business continuity and erode user trust. The unauthenticated nature of the attack means no valid credentials or prior system access is required—any network-adjacent attacker can exploit it.

Affected systems

FreeSWITCH prior to version 1.11.0 is vulnerable. Organizations should inventory all FreeSWITCH deployments and check version numbers immediately. This includes on-premise PBX systems, hosted VoIP solutions, and any telecommunications infrastructure built on FreeSWITCH. Self-hosted and cloud-based instances are equally at risk if not updated. Note that FreeSWITCH is widely used in open-source telephony stacks and may be embedded in third-party telecommunications appliances; verify your vendor's FreeSWITCH baseline version.

Exploitability

Exploitability is very high. The attack requires no authentication, no user interaction, and minimal attacker sophistication—crafting a SIP PUBLISH with a malicious PIDF body containing nested DTD entities is straightforward. An attacker needs only network reachability to a FreeSWITCH instance (typically on standard SIP ports 5060/5061 or custom configurations). The CVSS score of 7.5 (HIGH) reflects the ease of exploitation and complete availability impact, though confidentiality and integrity are unaffected. No KEV status currently assigned, but the combination of ease of exploit and immediate impact makes this a high-priority patch candidate.

Remediation

Upgrade FreeSWITCH to version 1.11.0 or later as soon as possible. This is the definitive fix—the patched version enforces limits on entity expansion depth and count, preventing the billion laughs attack. Before patching, consider network segmentation to restrict who can send SIP traffic to FreeSWITCH instances, though this is a workaround, not a solution. Monitoring for unusual SIP PUBLISH requests with malformed or deeply nested DTD structures may detect exploit attempts, but will not prevent the damage. Do not rely on authentication-based mitigations, since the vulnerability is triggered before auth checks.

Patch guidance

Update to FreeSWITCH 1.11.0 or any later stable release. Follow your organization's standard change management process: test the update in a non-production environment first, document the current version and configuration, back up any custom configurations or dialplans, then apply the patch during a maintenance window. Monitor system stability and call handling metrics post-update. If you are using FreeSWITCH as part of a third-party VoIP appliance or hosted provider, contact your vendor to confirm patch availability and timeline. Do not delay—this is a trivial unauthenticated DoS with immediate impact.

Detection guidance

Monitor for SIP PUBLISH requests directed at FreeSWITCH instances, particularly those containing PIDF bodies with unusual XML structure or deeply nested <!ENTITY> declarations. Inspect firewall and SIP proxy logs for anomalous PUBLISH traffic from external or untrusted sources. Watch for sudden spikes in CPU usage, memory consumption, or process crashes on FreeSWITCH servers, especially correlated with inbound SIP traffic. IDS/IPS signatures targeting billion laughs XML attacks may trigger on malicious payloads. Application-level logging in FreeSWITCH (if enabled) may show parser errors or hangs; check for correlations between those errors and service degradation. Be aware that a single malicious request causes immediate impact, so detection may occur too late for prevention—focus on rapid patching and network access controls.

Why prioritize this

This vulnerability merits urgent priority (P1/Critical patch cycle) due to: (1) unauthenticated network exploitability requiring zero credentials, (2) trivial attack execution—a single malicious SIP message triggers denial of service, (3) high-value target set (VoIP providers and carriers depend on FreeSWITCH), (4) immediate business impact on telecommunications availability, and (5) no meaningful workaround short of network isolation. Organizations running FreeSWITCH should treat this as a same-day or next-business-day patch target, not a routine update.

Risk score, explained

CVSS 7.5 (HIGH) reflects a network-exploitable vulnerability with no authentication or user interaction required, resulting in complete availability loss. The score appropriately weights the ease of exploitation and immediate DoS impact. However, the fact that a single request causes service-level degradation, combined with the unauthenticated and network-adjacent attack vector, argues for treating this as higher priority than the numeric score alone might suggest—particularly for organizations where telecommunications availability is critical to operations. The absence of KEV status does not reduce operational risk; it may simply reflect the recent publication date.

Frequently asked questions