Denial of Service Vulnerability in FreeSWITCH Software from SignalWire

CVE-2026-116787

What is CVE-2026-116787?

FreeSWITCH, a software-defined telecom stack, is affected by a vulnerability in the mod_event_socket module prior to version 1.11.2. This flaw allows an unauthenticated Content-Length value to be misused as the allocation size for an Event Socket message body. It poses a risk of process termination due to overflow situations or allocation failures, as the header is parsed before authentication occurs. This can lead to unwanted service disruptions, particularly if a malicious host exploits the issue to drop active calls. The vulnerability affects both local and remote connections and necessitates an upgrade to the fixed version 1.11.2 to mitigate these risks.

References