CVE-2026-49840 Details
Description
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.11.1, esl_recv_event() parses Content-Length with atol() and passes the result straight to malloc(len + 1) with no sign or magnitude check. A malicious or man-in-the-middle ESL peer can send a frame with a negative Content-Length to corrupt the heap of, or crash, any process linked against libesl, before the client has authenticated to that peer. This issue has been patched in version 1.11.1.
A heap buffer overflow vulnerability has been identified in FreeSWITCH versions prior to 1.11.1. The issue arises in the libesl component, where the function esl_recv_event() improperly parses the Content-Length header. It uses atol() to convert the header value and then directly passes the result to malloc(len + 1) without any validation. This flaw allows a malicious or man-in-the-middle ESL peer to send a frame with a negative Content-Length, leading to heap corruption or a crash in any process using libesl, before the client has authenticated. The vulnerability is present in the FreeSWITCH ESL protocol, which is intended for use on a trusted control plane.
Users are advised to upgrade to FreeSWITCH version 1.11.1 or later. For those unable to upgrade, it is recommended to restrict which hosts libesl clients connect to and keep the control-plane network isolated from less-trusted hosts.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/signalwire/freeswitch/releases/tag/v1.11.1 | [email protected] | Release Notes |
| https://github.com/signalwire/freeswitch/security/advisories/GHSA-g597-9fgg-ghg9 | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-122 | Heap-based Buffer Overflow | [email protected] |
| CWE-195 | Signed to Unsigned Conversion Error | [email protected] |
| CWE-20 | Improper Input Validation | [email protected] |
| CWE-787 | Out-of-bounds Write | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| freeswitch freeswitch | < 1.11.1 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 10, 2026 | Initial Analysis | [email protected] |
| Jun 9, 2026 | New CVE Received | [email protected] |