CVE-2026-116781
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, ws_read_frame() unmasked a WebSocket payload by iterating wsh->datalen, which included frame headers, while indexing from the payload pointer. A masked frame filling the 64 KiB receive buffer could therefore XOR up to 14 bytes beyond the buffer, and the exact-capacity case also wrote a terminating NUL one byte out of bounds. The flaw is reachable before authentication when mod_xml_rpc and its opt-in WebSocket endpoint are enabled, while both features are disabled in the stock configuration. The writes remain within the same connection handle's adjacent outbound buffer, so neither a process crash nor cross-session disclosure has been demonstrated. This issue is fixed in version 1.11.2.
- Score
- 5.3 medium
- Published
- 2026-11-05
- Links
- NVD · cve.org · Report wrong data
Matched ports (1)
| Port | Package | Version | Status | Maintainer |
|---|---|---|---|---|
| net/freeswitch | freeswitch | 1.11.1_3 | unaddressed | pi@FreeBSD.org |
Template for a VuXML entry
Check the version numbers before you commit this entry. Some ports share an entry in the CVE database with another port, such as sqlite2 and sqlite3. The version shown here may then be one that never existed for this port.
Ranges per package from the CVE rows that match this port, in pkg notation with the port's epoch and revision, every bound checked with pkg; one range per epoch the port actually had. make newentry in security/vuxml creates the vid.
<vuln vid="FIXME (make newentry)">
<topic>freeswitch -- FIXME</topic>
<affects>
<package>
<name>freeswitch</name>
<range><lt>1.11.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>CVE-2026-116781: FreeSWITCH is a Software Defined Telecom Stack
enabling the digital transformation from proprietary telecom
switches to a software implementation that runs on any commodity
hardware. Prior to 1.11.2, ws_read_frame() unmasked a WebSocket
payload by iterating wsh->datalen, which included frame headers,
while indexing from the payload pointer. A masked frame filling the
64 KiB receive buffer could therefore XOR up to 14 bytes beyond the
buffer, and the exact-capacity case also wrote a terminating NUL
one byte out of bounds. The flaw is reachable before authentication
when mod_xml_rpc and its opt-in WebSocket endpoint are enabled,
while both features are disabled in the stock configuration. The
writes remain within the same connection handle's adjacent outbound
buffer, so neither a process crash nor cross-session disclosure has
been demonstrated. This issue is fixed in version 1.11.2.</p>
</body>
</description>
<references>
<cvename>CVE-2026-116781</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2026-116781</url>
</references>
<dates>
<discovery>2026-11-05</discovery>
<entry>2026-11-05</entry>
</dates>
</vuln>