What is the CVSS score of CVE-2026-49841?

CVE-2026-49841 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of FreeSWITCH are affected by CVE-2026-49841?

FreeSWITCH mod_verto contains a critical heap buffer overflow vulnerability (CVE-2026-49841, CVSS 9.8) affecting the HTTP endpoint that can be exploited without authentication to corrupt heap memory…. A patch is available.

How to fix or mitigate CVE-2026-49841?

Within 24 hours: Conduct comprehensive inventory of FreeSWITCH deployments and identify instances with mod_verto HTTP endpoints exposed to untrusted networks. Implement immediate firewall rules restricting access to these endpoints. Within 7 days: Disable the mod_verto module if not operationally required; if necessary for business operations, deploy Web Application Firewall policies to restrict POST requests and filter Content-Length headers. Within 30 days: Monitor FreeSWITCH official releases for patched version 1.11.1 or later and establish upgrade timeline; document all compensating controls for audit and compliance purposes.

FreeSWITCH CVE-2026-49841

EUVD-2026-35472 CRITICAL

Heap-based Buffer Overflow (CWE-122)

2026-06-09 GitHub_M

Heap Overflow Buffer Overflow Freeswitch

9.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jun 09, 2026 - 18:02 EUVD

Source Code Evidence Fetched

Jun 09, 2026 - 16:47 vuln.today

Analysis Generated

Jun 09, 2026 - 16:47 vuln.today

DescriptionGitHub Advisory

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.11.1, the mod_verto HTTP request handler allocates a fixed 2 MiB buffer for a POST application/x-www-form-urlencoded body but accepts Content-Length up to just under 10 MiB. The body-read loop is bounded by Content-Length rather than the buffer size, producing an attacker-controlled heap overflow of up to ~8 MiB -- before the HTTP basic-auth check runs. This issue has been patched in version 1.11.1.

AnalysisAI

Heap buffer overflow in FreeSWITCH mod_verto prior to version 1.11.1 allows remote unauthenticated attackers to corrupt up to ~8 MiB of heap memory by sending a crafted HTTP POST request with an oversized Content-Length header. The flaw is triggered before HTTP basic-auth validation runs, enabling pre-authentication exploitation against any exposed mod_verto HTTP endpoint, with CVSS 9.8 reflecting potential for remote code execution; no public exploit identified at time of analysis.

Technical ContextAI

FreeSWITCH is an open-source software-defined telecom stack maintained by SignalWire (per the cpe:2.3:a:signalwire:freeswitch CPE). The vulnerability lives in mod_verto, the WebSocket/HTTP module that powers Verto signaling for WebRTC clients. Specifically, the HTTP POST handler for application/x-www-form-urlencoded bodies allocates a fixed 2 MiB heap buffer, but the body-read loop is bounded by the attacker-supplied Content-Length header (accepted up to just under 10 MiB) rather than the destination buffer's size. This is a classic CWE-122 heap-based buffer overflow caused by a length-check mismatch between allocation and copy, and critically the overflow occurs before HTTP basic authentication is enforced, making the vulnerable code path reachable by anonymous attackers.

RemediationAI

Vendor-released patch: upgrade FreeSWITCH to version 1.11.1 or later, which contains the 'mod_verto: Fix heap overflow in HTTP POST body read' fix listed in the v1.11.1 release notes at https://github.com/signalwire/freeswitch/releases/tag/v1.11.1; the GHSA-wfrq-qvg2-f88f advisory provides the coordinated disclosure details. Operators who cannot upgrade immediately should restrict network exposure of the mod_verto HTTP listener - bind it only to trusted interfaces, place it behind a reverse proxy or WAF that enforces a maximum Content-Length well under 2 MiB on POST application/x-www-form-urlencoded requests to Verto endpoints, or disable mod_verto entirely if WebRTC/Verto signaling is unused (trade-off: WebRTC clients will lose connectivity). Network ACLs limiting source IPs to known SIP/WebRTC clients reduce exposure but do not eliminate risk from compromised internal hosts.