Vulnerability · Published Jun 9, 2026 · Assigned by GitHub_M

CVE-2026-49841FreeSWITCH: Pre-authentication heap buffer overflow in `mod_verto` HTTP POST body read

Critical 9.8

In plain English

A critical-severity heap buffer overflow in freeswitch from signalwire. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)0.4%top 66.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.11.1, the mod_verto HTTP request handler allocates a fixed 2 MiB buffer for a POST application/x-www-form-urlencoded body but accepts Content-Length up to just under 10 MiB. The body-read loop is bounded by Content-Length rather than the buffer size, producing an attacker-controlled heap overflow of up to ~8 MiB -- before the HTTP basic-auth check runs. This issue has been patched in version 1.11.1.

Affected products (as reported)

Vendor	Product	Versions
signalwire	freeswitch	< 1.11.1

Weakness: CWE-122, CWE-131 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/signalwire/freeswitch/security/advisories/GHSA-wfrq-qvg2-f88f x_refsource_CONFIRM
https://github.com/signalwire/freeswitch/releases/tag/v1.11.1 x_refsource_MISC