Executive brief
FreeSWITCH is an open-source software-defined telephony platform used for routing and managing voice and video communications. A vulnerability in its XML processing allows an unauthenticated attacker to crash the service or exhaust system resources by sending a specially crafted SIP message. This can lead to a total outage of the phone system, disrupting business communications and emergency services.
Technical details
FreeSWITCH's bundled XML parser (src/switch_xml.c) fails to impose depth or count bounds on nested <!ENTITY> declarations within Document Type Definitions (DTDs). An unauthenticated attacker can send a SIP PUBLISH request containing a PIDF body with a malicious DTD designed for exponential entity expansion. Because this parsing occurs before digest authentication or ACL checks in mod_sofia, the attacker can force the system to exhaust CPU and memory (RAM), leading to a process crash or worker thread exhaustion. The vulnerability is patched in version 1.11.0 by implementing recursion depth and reference-visit limits.
Affected products
- SignalWire FreeSWITCH <= 1.10.12
Timeline
- 2026-05-14: advisory: GitHub Security Advisory published
- 2026-06-09: disclosed: CVE published to NVD
- 2026-05-07: patched: Version 1.11.0 released