Executive brief
FreeSWITCH is an open-source telecommunications platform used to handle voice, video, and messaging traffic. A critical vulnerability in its 'mod_verto' component allows an unauthenticated attacker to crash the service or potentially take control of the server by sending a specially crafted web request. This could lead to a total service outage, unauthorized access to communication data, or a foothold for further attacks on the corporate network.
Technical details
A heap-based buffer overflow exists in the mod_verto HTTP request handler of FreeSWITCH. The component allocates a fixed 2 MiB buffer for 'application/x-www-form-urlencoded' POST bodies but permits a Content-Length of up to 10 MiB. Because the body-read loop is bounded by the Content-Length header rather than the allocated buffer size, an unauthenticated remote attacker can trigger an overflow of approximately 8 MiB. This occurs before HTTP basic authentication is processed. Exploitation can lead to immediate denial of service via heap corruption, information disclosure, or remote code execution. The vulnerability is reachable only when at least one <vhost> is configured in the verto profile. A fix is available in version 1.11.1.
Affected products
- SignalWire FreeSWITCH <= 1.11.0
Timeline
- 2026-05-26: patched: Version 1.11.1 released
- 2026-06-03: advisory: GitHub Security Advisory published
- 2026-06-09: disclosed: CVE published to NVD