Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.11.0, FreeSWITCH's bundled XML parser expands nested <!ENTITY> declarations without a depth or count bound, so a small DTD can describe a body that expands exponentially ("billion laughs"). The PIDF body of a SIP PUBLISH is fed to this parser before any digest check, letting an unauthenticated network attacker force unbounded CPU and memory consumption with a single request. This issue has been patched in version 1.11.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
3/ On the vuln side: FreeSWITCH 1.11.0/1.11.1 fix an unauthenticated SIP PUBLISH DoS (CVE-2026-45771) and more; OpenSIPS shipped 12 advisories / 8 CVEs (3 critical); coturn and Janus got security updates too.
Post summary
The message summarizes recent security updates, noting that FreeSWITCH, OpenSIPS, coturn, and Janus have released patches that fix multiple CVEs, including an unauthenticated SIP PUBLISH DoS (CVE-2026-45771).
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | freeswitch | freeswitch | - | - | - |