CVE-2026-49841Disclosure(freeswitch / freeswitch)

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch freeswitch freeswitch systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.11.1, the mod_verto HTTP request handler allocates a fixed 2 MiB buffer for a POST application/x-www-form-urlencoded body but accepts Content-Length up to just under 10 MiB. The body-read loop is bounded by Content-Length rather than the buffer size, producing an attacker-controlled heap overflow of up to ~8 MiB -- before the HTTP basic-auth check runs. This issue has been patched in version 1.11.1.

freeswitch CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://github.com/signalwire/freeswitch/security/advisories/GHSA-wfrq-qvg2-f88f

Other references

https://github.com/signalwire/freeswitch/releases/tag/v1.11.1

Weakness type (CWE)

CWE-122CWE-131

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

freeswitch

Threat summary

Patch or workaround signal is available
2 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 2 signals
Disclosure: 1 classified signal
Peaked 1d ago at 1 mentions (2026-06-10); latest day: 1
2 total mentions across 2 days

Affected systems

Vendors

freeswitch

Products

freeswitch

Deep dive

Activity timeline2 mentions / 2d

Signal classification2 categories

Disclosure

150.0%

Patch

150.0%

Referenced assets2 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-10	1	Disclosure1
2026-06-16	1	Patch1

Full discourse2 posts

Daily CyberSecurity@the_yellow_fall132d
Patch
Two pre-auth FreeSWITCH heap buffer overflow bugs (CVE-2026-49841, CVE-2026-49840) hit mod_verto and libesl. Update to v1.11.1 to stay safe. #FreeSWITCH #CVE202649841 #CVE202649840 #HeapOverflow #InfoSec https://securityonline.info/freeswitch-heap-buffer-overflow-cve-2026-49841 https://t.co/V1xpbXh4I8
Post summary
Two pre‑authentication heap buffer overflow vulnerabilities in FreeSWITCH have been disclosed; users are advised to upgrade to version 1.11.1 to mitigate the risk.
01032247
12.8K followersView on X
DailyCVE@dailycve137d
Disclosure
🔴 FreeSWITCH: Pre‑authentication heap buffer overflow in HTTP POST body read, #CVE‑2026‑49841 (CRITICAL) -DC-Jun2026-349 https://dailycve.com/freeswitch-pre-authentication-heap-buffer-overflow-in-http-post-body-read-cve-2026-49841-critical-dc-jun2026-349/
Post summary
The post announces the discovery of a critical pre‑authentication heap buffer overflow in FreeSWITCH (CVE‑2026‑49841), presenting the vulnerability type but no exploit details or mitigations.
0000041
210 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	freeswitch	freeswitch	-	-	-

Explore more

Back to dashboard freeswitch CVEs freeswitch vulnerabilities