Executive brief
FreeSWITCH is an open-source telephony platform used by businesses to build voice and messaging applications. A security flaw was identified in its internal XML processing component, which was inherited from an outdated third-party library. If exploited, this could allow an attacker to cause service disruptions or system instability, potentially impacting communication services and business operations.
Technical details
FreeSWITCH prior to version 1.11.0 contains a vulnerable function, PREFIX(prologTok)(), within its bundled xmlrpc-c library (libs/xmlrpc-c/lib/expat/xmltok/xmltok_impl.c). This code was originally cloned from libexpat but did not receive the security patches applied to the upstream project. The vulnerability is classified under CWE-116 (Improper Encoding or Escaping of Output) and can lead to memory corruption or a denial-of-service (DoS) condition. Exploitation requires network access with low privileges and faces high attack complexity. The issue is resolved in FreeSWITCH version 1.11.0 by applying the missing upstream security patches.
Affected products
- SignalWire FreeSWITCH < 1.11.0
Timeline
- 2026-05-07: patched: Version 1.11.0 released
- 2026-06-03: advisory: GitHub Security Advisory published
- 2026-06-09: disclosed: CVE published to NVD