CVE-2026-49841 Details
Description
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.11.1, the mod_verto HTTP request handler allocates a fixed 2 MiB buffer for a POST application/x-www-form-urlencoded body but accepts Content-Length up to just under 10 MiB. The body-read loop is bounded by Content-Length rather than the buffer size, producing an attacker-controlled heap overflow of up to ~8 MiB -- before the HTTP basic-auth check runs. This issue has been patched in version 1.11.1.
A heap buffer overflow vulnerability has been identified in FreeSWITCH versions prior to 1.11.1, specifically within the mod_verto HTTP request handler. The vulnerability arises because the handler allocates a fixed 2 MiB buffer for POST application/x-www-form-urlencoded bodies but accepts Content-Length headers of nearly 10 MiB. This discrepancy allows for an attacker-controlled heap overflow of approximately 8 MiB, occurring before the HTTP basic authentication check is applied. The issue is reachable on verto profiles with at least one vhost configured, typically when serving files or landing pages via Verto Communicator deployments.
Users can upgrade to FreeSWITCH version 1.11.1 or later, restrict the verto listener to trusted networks, remove all vhost entries from the verto profile, or disable mod_verto if it is not in use.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/signalwire/freeswitch/releases/tag/v1.11.1 | [email protected] | Release Notes |
| https://github.com/signalwire/freeswitch/security/advisories/GHSA-wfrq-qvg2-f88f | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-122 | Heap-based Buffer Overflow | [email protected] |
| CWE-131 | Incorrect Calculation of Buffer Size | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| freeswitch freeswitch | < 1.11.1 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 10, 2026 | Initial Analysis | [email protected] |
| Jun 9, 2026 | New CVE Received | [email protected] |