CVE-2026-49840

FreeSWITCH: Pre-authentication heap buffer overflow in libesl `Content-Length` parsing

State: Published
Severity: 9.1 Critical
Published: Jun 9, 2026
Updated: Jun 9, 2026
Reserved: Jun 1, 2026

Description

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.11.1, esl_recv_event() parses Content-Length with atol() and passes the result straight to malloc(len + 1) with no sign or magnitude check. A malicious or man-in-the-middle ESL peer can send a frame with a negative Content-Length to corrupt the heap of, or crash, any process linked against libesl, before the client has authenticated to that peer. This issue has been patched in version 1.11.1.

Scores

CVSS	Score	Vector	Source
3.1	9.1 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H	GitHub_M

Weaknesses

CWE-20 Improper Input Validation
CWE-122 Heap-based Buffer Overflow
CWE-195 Signed to Unsigned Conversion Error
CWE-787 Out-of-bounds Write

Affected Products

Product	Versions
freeswitchsignalwire	< 1.11.1Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.