CVE-2026-116787
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, mod_event_socket used an unauthenticated Content-Length value directly as the allocation size for an Event Socket message body. Negative or extremely large values could overflow the terminator calculation or force an allocation failure through a helper that aborts the FreeSWITCH process. The header is parsed before the Event Socket password, so any host admitted by apply-inbound-acl can trigger termination with its first packet; the default loopback ACL limits ordinary installations to local clients. The outbound socket dialplan path is also affected when FreeSWITCH connects to a hostile application server, and process termination drops every active call until the service is restarted. This issue is fixed in version 1.11.2.
- Score
- 7.5 high
- Published
- 2026-11-05
- Links
- NVD · cve.org · Report wrong data
Matched ports (1)
| Port | Package | Version | Status | Maintainer |
|---|---|---|---|---|
| net/freeswitch | freeswitch | 1.11.1_3 | unaddressed | pi@FreeBSD.org |
Template for a VuXML entry
Check the version numbers before you commit this entry. Some ports share an entry in the CVE database with another port, such as sqlite2 and sqlite3. The version shown here may then be one that never existed for this port.
Ranges per package from the CVE rows that match this port, in pkg notation with the port's epoch and revision, every bound checked with pkg; one range per epoch the port actually had. make newentry in security/vuxml creates the vid.
<vuln vid="FIXME (make newentry)">
<topic>freeswitch -- FIXME</topic>
<affects>
<package>
<name>freeswitch</name>
<range><lt>1.11.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>CVE-2026-116787: FreeSWITCH is a Software Defined Telecom Stack
enabling the digital transformation from proprietary telecom
switches to a software implementation that runs on any commodity
hardware. Prior to 1.11.2, mod_event_socket used an unauthenticated
Content-Length value directly as the allocation size for an Event
Socket message body. Negative or extremely large values could
overflow the terminator calculation or force an allocation failure
through a helper that aborts the FreeSWITCH process. The header is
parsed before the Event Socket password, so any host admitted by
apply-inbound-acl can trigger termination with its first packet;
the default loopback ACL limits ordinary installations to local
clients. The outbound socket dialplan path is also affected when
FreeSWITCH connects to a hostile application server, and process
termination drops every active call until the service is restarted.
This issue is fixed in version 1.11.2.</p>
</body>
</description>
<references>
<cvename>CVE-2026-116787</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2026-116787</url>
</references>
<dates>
<discovery>2026-11-05</discovery>
<entry>2026-11-05</entry>
</dates>
</vuln>