CVE-2026-49840: falha crítica em signalwire freeswitch
FreeSWITCH: Pre-authentication heap buffer overflow in libesl `Content-Length` parsing
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.1epss 0.3%
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.11.1, esl_recv_event() parses Content-Length with atol() and passes the result straight to malloc(len + 1) with no sign or magnitude check. A malicious or man-in-the-middle ESL peer can send a frame with a negative Content-Length to corrupt the heap of, or crash, any process linked against libesl, before the client has authenticated to that peer. This issue has been patched in version 1.11.1.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Produtos afetados
signalwire · freeswitchCVEs relacionadas — signalwire freeswitch
No mesmo produto, das mais perigosas para as menos.
CVE-2026-116779CRITICALFreeSWITCH: Inbound SIP MESSAGE can select the api chat proto and run FreeSWITCH API commandsEPSS 1.3%KEVCVE-2021-37624HIGHFreeSWITCH does not authenticate SIP MESSAGE requests, leading to spam and message spoofingEPSS 3.8%CVE-2021-41105HIGHFreeSWITCH susceptible to Denial of Service via invalid SRTP packetsEPSS 2.5%CVE-2021-41157MEDIUMFreeSWITCH does not authenticate SIP SUBSCRIBE requests by defaultEPSS 1.7%CVE-2021-41145HIGHFreeSWITCH susceptible to Denial of Service via SIP floodingEPSS 1.7%CVE-2023-51443HIGHFreeSWITCH susceptible to Denial of Service via DTLS Hello packets during call initiationEPSS 1.5%