SB2026051551 - XML Entity Expansion in freeswitch
Published: May 15, 2026
Security Bulletin ID
SB2026051551
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Denial of service
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 vulnerability.
1) XML Entity Expansion (CVE-ID: CVE-2026-45771)
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper restriction of recursive entity references in DTDs in the core XML parser when parsing the PIDF body of a SIP PUBLISH request. A remote attacker can send a specially crafted SIP PUBLISH request containing nested XML entity declarations to cause a denial of service.
Only SIP profiles with manage-presence enabled are vulnerable, and the PIDF body is parsed before any registration, ACL, or digest check.
Remediation
Install update from vendor's website.