CVE-2026-45771 Details

A denial-of-service vulnerability has been identified in FreeSWITCH versions prior to 1.11.0. The issue arises in the core XML parser, which expands nested entity declarations without limits, allowing a small DTD to create a body that grows exponentially, similar to the 'billion laughs' attack. This vulnerability is accessible through the PIDF body of a SIP PUBLISH request, before any authentication or digest checks, enabling an unauthenticated network attacker to cause excessive CPU and memory usage with a single request. The problem is exacerbated by the fact that the expansion occurs after the transport is secured with TLS, leaving the system vulnerable even when using encrypted connections.

Users are advised to upgrade to FreeSWITCH version 1.11.0 or later, where this vulnerability has been patched. Instructions for upgrading can be found in the FreeSWITCH release notes.