CVE-2026-49472: FreeSWITCH XML Parser Denial of Service (MEDIUM)

Technical summary

CVE-2026-49472 affects the PREFIX(prologTok)() function located in libs/xmlrpc-c/lib/expat/xmltok/xmltok_impl.c within FreeSWITCH. This function was derived from a vulnerable version of libexpat and failed to incorporate the corresponding security patch applied to the upstream library. The flaw results in improper input handling (CWE-116) during XML token processing. Exploitation requires authentication and careful manipulation of XML parsing conditions, as indicated by the High complexity factor in the CVSS vector, but successful exploitation leads to availability loss through denial of service.

Business impact

Denial of service against FreeSWITCH deployments disrupts voice and data communications handled by the platform. Organizations running FreeSWITCH as a core telephony or communication infrastructure component face service interruption risk. Since exploitation requires authentication, the threat is primarily from internal users or compromised accounts rather than anonymous external attackers. However, in multi-tenant or cloud-hosted scenarios, a single authenticated user could impact shared services.

Affected systems

FreeSWITCH versions before 1.11.0 are affected. The vulnerability exists in the bundled xmlrpc-c library's Expat XML parser component. Any deployment using FreeSWITCH for call routing, conferencing, IVR, or other telephony functions prior to version 1.11.0 should be considered in scope. The flaw is specific to the bundled code path and may not affect alternative XML parsing implementations if separately integrated.

Exploitability

While the vulnerability is network-accessible and requires only low-privilege authentication, successful exploitation is not trivial. The CVSS vector indicates high attack complexity (AC:H), meaning an attacker must craft specific XML input conditions to trigger the flaw. This is not a one-click exploit scenario. The requirement for authenticated access significantly limits the threat surface compared to unauthenticated remote code execution flaws. Current evidence suggests this vulnerability is not yet actively exploited in the wild, as it does not appear on CISA's Known Exploited Vulnerabilities list.

Remediation

Upgrade FreeSWITCH to version 1.11.0 or later, which incorporates the necessary security patch to the prologTok() function. Organizations unable to upgrade immediately should implement network-level access controls to restrict authenticated user sessions and monitor XML-based API requests for anomalous patterns. Consider disabling unused XML-RPC functionality if not required for operations.

Patch guidance

Apply FreeSWITCH version 1.11.0 or newer. Verify the patch application by confirming the version string in the FreeSWITCH console or via administrative API. Test the upgrade in a non-production environment first to ensure compatibility with existing dialplans, modules, and integrations. The patch was made available as of the vulnerability disclosure date (2026-06-09); check your vendor repositories and deployment channels for availability.

Detection guidance

Monitor FreeSWITCH logs for XML parsing errors or unexpected termination of the core process, particularly following unusual API calls or configuration reloads. Network-based detection should focus on authenticated session anomalies and high-frequency or malformed XML-RPC requests. Vulnerability scanners can identify FreeSWITCH version numbers; cross-reference against the 1.11.0 cutoff. Host-based monitoring should alert on FreeSWITCH process crashes or restarts without corresponding administrative actions.

Why prioritize this

Although the CVSS score is moderate (5.3), the high complexity requirement and need for authentication significantly reduce practical risk in most environments. Prioritize this as a standard security update rather than an emergency. However, organizations in security-sensitive sectors (healthcare call centers, emergency services) should treat this with higher urgency given the availability impact. Environments with hostile internal users or those exposed to compromised accounts warrant faster remediation.

Risk score, explained

The CVSS 3.1 score of 5.3 (MEDIUM) reflects a network-accessible flaw with authentication requirements and high attack complexity, resulting only in availability impact. The score appropriately penalizes the lack of confidentiality and integrity compromise. However, context matters: the real-world risk depends on your deployment model, the privilege level of typical authenticated users, and the criticality of FreeSWITCH availability in your infrastructure. A telecom carrier running FreeSWITCH as core infrastructure faces higher operational risk than an organization using it for peripheral functions.

Frequently asked questions