FreeSWITCH CVE-2026-49847

The target must run a FreeSWITCH version prior to 1.11.1 with a WebSocket-accepting module enabled - primarily mod_verto, which exposes a JSON-over-WebSocket signaling interface - and that WebSocket listener must be reachable on the network from the attacker. No authentication, no user interaction, and no specific tenant or call state are required (CVSS PR:N/UI:N), and the malicious payload is a single WebSocket frame containing a deeply nested JSON document, so exploitation is feasible against default mod_verto configurations once the port is reachable. Limiting factors: deployments that do not enable mod_verto or any other JSON-over-WebSocket module are not exposed via this path; deployments that firewall the Verto WebSocket ports to trusted client networks materially reduce reachability; and the impact is bounded to availability - the kernel raises SIGSEGV from the stack guard page before any usable write primitive develops, so code execution is not achievable through this bug.

All available signals converge on a high-availability, no-confidentiality/integrity-impact denial-of-service: CVSS 7.5 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H confirms remote, unauthenticated, low-complexity exploitation with availability-only impact, consistent with the description of a single-frame crash. The vulnerability is not present in CISA KEV and no public exploit identified at time of analysis; EPSS data was not provided in the input. SSVC factors were not supplied, but inferring from the data: exploitation status is 'none' (no KEV/POC), automatable is plausibly 'yes' (a single crafted frame against any reachable WebSocket endpoint), and technical impact is 'partial' (DoS only, no code execution since the kernel kills the process before a write primitive forms). The realistic risk is meaningful for organizations exposing mod_verto WebSocket endpoints to untrusted networks (carriers, contact centers, hosted PBX), where a one-packet outage of all concurrent calls is a material operational event; for FreeSWITCH deployments that are not internet-exposed or do not enable WebSocket signaling, real-world risk is materially lower than the 7.5 score suggests.

An attacker scans the internet for FreeSWITCH hosts exposing mod_verto WebSocket endpoints (commonly TCP 8081/8082) and opens an unauthenticated WebSocket connection. They send a single frame containing a JSON document with thousands of nested arrays or objects (for example, '[[[[[...]]]]]'), causing the worker thread's recursive cJSON parse to overflow the stack and trigger SIGSEGV, killing the FreeSWITCH process and dropping every active call and session on the host. No public POC has been identified, but the trigger is trivially constructible from the release-note description ('Cap cJSON parser nesting depth') and requires no authentication or user interaction.