WebSocket Payload Vulnerability in FreeSWITCH Software by SignalWire

CVE-2026-116781

What is CVE-2026-116781?

FreeSWITCH, a Software Defined Telecom Stack, is vulnerable due to an improper input validation in the ws_read_frame() function. Prior to version 1.11.2, the function inadequately handled masked WebSocket payloads by iterating through frame headers without properly managing the buffer limits. This could allow an attacker to exploit the flaw by causing the payload to exceed the allocated 64 KiB receive buffer, potentially leading to unintended memory writes. While this vulnerability is reachable before authentication when both mod_xml_rpc and its opt-in WebSocket endpoint are active, it is important to acknowledge that in the default configuration, these features are typically disabled. No process crashes or cross-session disclosures have been reported as a result of this issue. Mitigation is available in version 1.11.2, which addresses the flaw effectively.

References