What is the CVSS score of CVE-2026-49842?

CVE-2026-49842 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of FreeSWITCH are affected by CVE-2026-49842?

FreeSWITCH versions prior to 1.11.1 contain an unauthenticated bandwidth amplification flaw in the mod_verto WebSocket module that allows remote attackers to trigger approximately 20 GB of outbound…. A patch is available.

How to fix or mitigate CVE-2026-49842?

Within 24 hours: inventory all FreeSWITCH installations and document network exposure; verify whether mod_verto WebSocket module is required for production operations. Within 7 days: disable mod_verto module on all systems where not required; implement strict IP whitelisting and rate limiting (e.g., max 1 request/second per IP) on #SPU speed-test endpoint for retained instances; deploy upstream bandwidth throttling or DDoS mitigation. Within 30 days: upgrade FreeSWITCH to version 1.11.1 or later when available from vendor; conduct egress bandwidth monitoring for anomaly detection.

FreeSWITCH CVE-2026-49842

EUVD-2026-35473 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-06-09 GitHub_M

Denial Of Service Freeswitch

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Jun 09, 2026 - 18:02 EUVD

Source Code Evidence Fetched

Jun 09, 2026 - 16:47 vuln.today

Analysis Generated

Jun 09, 2026 - 16:47 vuln.today

DescriptionGitHub Advisory

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.11.1, mod_verto's WebSocket frame loop intercepts a #-prefixed speed-test protocol (#SPU / #SPB / #SPE) before any authentication check. The declared payload size in #SPU was parsed with atoi() and only rejected non-positive values, so an unauthenticated peer could request up to INT_MAX bytes. The server then wrote roughly size * 10 bytes back during the download phase, on the order of 20 GB per request, yielding strong outbound bandwidth amplification from a short request. This issue has been patched in version 1.11.1.

AnalysisAI

Unauthenticated outbound bandwidth amplification in FreeSWITCH versions prior to 1.11.1 allows remote attackers to coerce the server into emitting roughly 20 GB of traffic per short request via the mod_verto WebSocket #SPU speed-test command. The pre-auth code path parses the requested payload size with atoi() and only rejects non-positive values, letting a peer ask for up to INT_MAX bytes and triggering a size*10 download. No public exploit is identified at time of analysis, but the high-severity CVSS (7.5, A:H) and trivial trigger make this a credible DDoS-as-a-service primitive.

Technical ContextAI

FreeSWITCH (Signalwire) is an open-source software-defined telecom switch; mod_verto is its WebSocket-based signaling module for the Verto WebRTC protocol. The flaw sits in mod_verto's WebSocket frame loop, which inspects incoming frames for a '#'-prefixed speed-test sub-protocol (#SPU upload, #SPB bidirectional, #SPE end) before invoking the authentication gate. Per CWE-400 (Uncontrolled Resource Consumption), the #SPU handler converts the attacker-supplied payload-size string using atoi() with only a non-positive-value guard, then the download phase writes approximately ten times that value back to the peer - a classic missing upper-bound check producing bandwidth amplification rather than memory exhaustion. The CPE identifies signalwire:freeswitch in all versions matching the wildcard up to but not including 1.11.1.

RemediationAI

Vendor-released patch: upgrade to FreeSWITCH 1.11.1 (https://github.com/signalwire/freeswitch/releases/tag/v1.11.1), which moves the #SPU/#SPB/#SPE speed-test handlers behind the authentication gate and is the authoritative fix per advisory GHSA-p3gx-p2w7-wp35. If immediate upgrade is not possible, restrict network exposure of the mod_verto WebSocket listener (commonly TCP 8081/8082) at the firewall to known WebRTC client networks, or unload mod_verto entirely via fs_cli 'unload mod_verto' if Verto signaling is unused - the trade-off is loss of all WebRTC/Verto-based call handling for that node. As a narrower mitigation, terminate the WebSocket behind a reverse proxy that enforces per-IP egress byte caps and request-rate limits so a single connection cannot draw 20 GB of response traffic; this preserves Verto functionality but adds proxy latency and an operational dependency. Do not rely on authentication on the upstream Verto user accounts as a control - the vulnerable code path runs before any password check.