Uncontrolled Memory Allocation in freeswitch - CVE-2026-116787
Published: November 9, 2026
Vulnerability identifier: #VU162790
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-116787
CWE-ID: CWE-789
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to terminate FreeSWITCH, dropping all active calls until the service is restarted.
The vulnerability exists due to unbounded memory allocation from the Event Socket Content-Length header before authentication. An unauthenticated remote attacker can trigger fatal allocation failure with one oversized request through an address admitted by apply-inbound-acl (loopback-only by default) or an outbound application server they control.
Affected software
freeswitch
How to mitigate CVE-2026-116787
Install security update from vendor's website.
freeswitch - update to 1.11.2