Executive brief
FreeSWITCH is an open-source telephony platform used to manage voice, video, and messaging communications. A vulnerability in how the system processes certain data formats allows an unauthenticated remote attacker to crash the entire service by sending a single malicious message. This results in a total service outage, immediately terminating all active phone calls and communication sessions on the affected server.
Technical details
FreeSWITCH contains an uncontrolled recursion vulnerability in its bundled cJSON parser. The parser uses recursive descent to process JSON objects and arrays; however, the default nesting limit exceeds the available stack size (240 KiB) of the FreeSWITCH worker threads. An unauthenticated attacker can send a specially crafted, deeply nested JSON document via a mod_verto WebSocket frame (typically on ports 8081 or 8082) to trigger a stack overflow. This results in a SIGSEGV (segmentation fault) that crashes the FreeSWITCH process before authentication occurs. The issue is fixed in version 1.11.1 by capping the CJSON_NESTING_LIMIT to 64.
Affected products
- SignalWire FreeSWITCH < 1.11.1
Timeline
- 2026-05-26: patched: Version 1.11.1 released
- 2026-06-03: advisory: GitHub Security Advisory published
- 2026-06-09: disclosed: CVE published to NVD