Is CVE-2026-49847 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-49847 being exploited in the wild.

How severe is CVE-2026-49847?

High severity, with a CVSS score of 7.5, published 9 June 2026.

Which products and versions are affected?

SignalWire FreeSWITCH < 1.11.1.

Is there a fix for CVE-2026-49847?

A patch was published on 2026-05-26: Version 1.11.1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-49847 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-49847?

Check whether you run SignalWire FreeSWITCH at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-49847: FreeSWITCH stack overflow in cJSON parser via mod_verto

Q: Is there a fix for CVE-2026-49847?

A patch was published on 2026-05-26: Version 1.11.1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-49847 attacked?

It is attacked over the network, in a hosted service.

Q: Am I affected by CVE-2026-49847?

Check whether you run SignalWire FreeSWITCH at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-49847 · Severity: high · CVSS 7.5 · Published 2026-06-09

FreeSWITCH is an open-source telephony platform used to manage voice, video, and messaging communications. A vulnerability in how the system processes certain data formats allows an unauthenticated remote attacker to crash the entire service by sending a single malicious message. This results in a total service outage, immediately terminating all active phone calls and communication sessions on the affected server.

Technologies: SignalWire FreeSWITCH. Vendors: SignalWire.

Quick answers

Is CVE-2026-49847 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-49847 being exploited in the wild.
How severe is CVE-2026-49847?: High severity, with a CVSS score of 7.5, published 9 June 2026.
Which products and versions are affected?: SignalWire FreeSWITCH < 1.11.1.
Is there a fix for CVE-2026-49847?: A patch was published on 2026-05-26: Version 1.11.1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-49847 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-49847?: Check whether you run SignalWire FreeSWITCH at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

FreeSWITCH contains an uncontrolled recursion vulnerability in its bundled cJSON parser. The parser uses recursive descent to process JSON objects and arrays; however, the default nesting limit exceeds the available stack size (240 KiB) of the FreeSWITCH worker threads. An unauthenticated attacker can send a specially crafted, deeply nested JSON document via a mod_verto WebSocket frame (typically on ports 8081 or 8082) to trigger a stack overflow. This results in a SIGSEGV (segmentation fault) that crashes the FreeSWITCH process before authentication occurs. The issue is fixed in version 1.11.1 by capping the CJSON_NESTING_LIMIT to 64.

Affected products

SignalWire FreeSWITCH < 1.11.1

Timeline

2026-05-26: patched: Version 1.11.1 released
2026-06-03: advisory: GitHub Security Advisory published
2026-06-09: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.