Executive brief
FreeSWITCH is an open-source telephony platform used for building communication systems like VoIP and PBX. A vulnerability in its Event Socket Library (libesl) allows a malicious server or a man-in-the-middle attacker to crash or corrupt the memory of applications that connect to it. This can lead to service outages or unauthorized system manipulation before any authentication takes place.
Technical details
A heap-based buffer overflow and signed-to-unsigned conversion error exist in the esl_recv_event() function of libesl. The function parses the 'Content-Length' header using atol() and passes the result to malloc() without validating the sign or magnitude. An attacker acting as an ESL peer can provide a negative value (e.g., -1), leading to a small allocation followed by an out-of-bounds write, or a larger negative value leading to a NULL pointer dereference and process crash. This occurs pre-authentication, affecting any tool linked against libesl such as fs_cli, mod_esl, and mod_hash. The issue is fixed in version 1.11.1 by implementing a 16 MiB cap and proper runtime checks.
Affected products
- SignalWire FreeSWITCH <= 1.11.0
Timeline
- 2026-05-26: patched: Version 1.11.1 released
- 2026-06-03: advisory: GitHub Security Advisory published
- 2026-06-09: disclosed: CVE published to NVD