CVE-2026-49840

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.11.1, esl_recv_event() parses Content-Length with atol() and passes the result straight to malloc(len + 1) with no sign or magnitude check. A malicious or man-in-the-middle ESL peer can send a frame with a negative Content-Length to corrupt the heap of, or crash, any process linked against libesl, before the client has authenticated to that peer. This issue has been patched in version 1.11.1.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/signalwire/freeswitch/releases/tag/v1.11.1	Release Notes
https://github.com/signalwire/freeswitch/security/advisories/GHSA-g597-9fgg-ghg9	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:freeswitch:freeswitch:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-06-09 17:17

Updated : 2026-07-23 08:10

NVD link : CVE-2026-49840

Mitre link : CVE-2026-49840

CVE.ORG link : CVE-2026-49840

JSON object : View

Products Affected

freeswitch

freeswitch

CWE

CWE-20

Improper Input Validation

CWE-122

Heap-based Buffer Overflow

CWE-195

Signed to Unsigned Conversion Error

CWE-787

Out-of-bounds Write

{"id": "CVE-2026-49840", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-49840", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-09T16:59:32.826404Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "signalwire", "product": "freeswitch", "versions": [{"status": "affected", "version": "< 1.11.1"}]}]}], "published": "2026-06-09T17:17:47.703", "references": [{"url": "https://github.com/signalwire/freeswitch/releases/tag/v1.11.1", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/signalwire/freeswitch/security/advisories/GHSA-g597-9fgg-ghg9", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-122"}, {"lang": "en", "value": "CWE-195"}, {"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.11.1, esl_recv_event() parses Content-Length with atol() and passes the result straight to malloc(len + 1) with no sign or magnitude check. A malicious or man-in-the-middle ESL peer can send a frame with a negative Content-Length to corrupt the heap of, or crash, any process linked against libesl, before the client has authenticated to that peer. This issue has been patched in version 1.11.1."}, {"lang": "es", "value": "FreeSWITCH es una Pila de Telecomunicaciones Definida por Software que permite la transformaci\u00f3n digital desde conmutadores de telecomunicaciones propietarios a una implementaci\u00f3n de software que se ejecuta en cualquier hardware comercial. Antes de la versi\u00f3n 1.11.1, esl_recv_event() analiza Content-Length con atol() y pasa el resultado directamente a malloc(len + 1) sin verificaci\u00f3n de signo o magnitud. Un par ESL malicioso o man-in-the-middle puede enviar una trama con un Content-Length negativo para corromper el heap de, o bloquear, cualquier proceso enlazado contra libesl, antes de que el cliente se haya autenticado con ese par. Este problema ha sido parcheado en la versi\u00f3n 1.11.1."}], "lastModified": "2026-07-23T08:10:00.137", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:freeswitch:freeswitch:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E8AED0D0-D5A1-4AA1-9CAE-13830B74CAC5", "versionEndExcluding": "1.11.1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}