What is the CVSS score of CVE-2026-45771?

CVE-2026-45771 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Freeswitch are affected by CVE-2026-45771?

FreeSWITCH deployments prior to version 1.11.0 are vulnerable to unauthenticated remote denial-of-service attacks that can exhaust critical communications infrastructure.. A patch is available.

How to fix or mitigate CVE-2026-45771?

24 hours: Inventory all FreeSWITCH instances by version; restrict network access to SIP ports (5060/5061) to authorized endpoints only using firewall rules. 7 days: Deploy IDS/WAF rules to detect and block malformed XML payloads in SIP PUBLISH requests; enable detailed SIP transaction logging; configure monitoring for CPU/memory spikes on affected systems. 30 days: Stage and test FreeSWITCH 1.11.0 when vendor releases; plan emergency patch deployment; evaluate managed VoIP service alternatives if on-premise remediation timeline extends beyond risk tolerance.

Freeswitch CVE-2026-45771

EUVD-2026-35468 HIGH

Improper Restriction of Recursive Entity References in DTDs (CWE-776)

2026-06-09 GitHub_M

Information Disclosure Freeswitch

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Jun 09, 2026 - 18:02 EUVD

Source Code Evidence Fetched

Jun 09, 2026 - 16:45 vuln.today

Analysis Generated

Jun 09, 2026 - 16:45 vuln.today

DescriptionGitHub Advisory

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.11.0, FreeSWITCH's bundled XML parser expands nested <!ENTITY> declarations without a depth or count bound, so a small DTD can describe a body that expands exponentially ("billion laughs"). The PIDF body of a SIP PUBLISH is fed to this parser before any digest check, letting an unauthenticated network attacker force unbounded CPU and memory consumption with a single request. This issue has been patched in version 1.11.0.

AnalysisAI

Denial of service in FreeSWITCH versions prior to 1.11.0 allows unauthenticated remote attackers to exhaust CPU and memory by sending a single SIP PUBLISH request whose PIDF body contains a malicious DTD with nested entity declarations. The bundled XML parser expands these entities before any digest authentication check, making this a pre-auth resource exhaustion vector (CWE-776, classic 'billion laughs'). No public exploit identified at time of analysis, but the CVSS 7.5 availability-only impact reflects a high-confidence DoS condition against any exposed FreeSWITCH instance.