FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.11.1, the mod_verto HTTP request handler allocates a fixed 2 MiB buffer for a POST application/x-www-form-urlencoded body but accepts Content-Length up to just under 10 MiB. The body-read loop is bounded by Content-Length rather than the buffer size, producing an attacker-controlled heap overflow of up to ~8 MiB -- before the HTTP basic-auth check runs. This issue has been patched in version 1.11.1.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
References
History
Tue, 09 Jun 2026 16:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.11.1, the mod_verto HTTP request handler allocates a fixed 2 MiB buffer for a POST application/x-www-form-urlencoded body but accepts Content-Length up to just under 10 MiB. The body-read loop is bounded by Content-Length rather than the buffer size, producing an attacker-controlled heap overflow of up to ~8 MiB -- before the HTTP basic-auth check runs. This issue has been patched in version 1.11.1. | |
| Title | FreeSWITCH: Pre-authentication heap buffer overflow in `mod_verto` HTTP POST body read | |
| Weaknesses | CWE-122 CWE-131 |
|
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2026-06-09T16:02:24.116Z
Reserved: 2026-06-01T18:50:36.057Z
Link: CVE-2026-49841
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-06-09T17:17:47.870
Modified: 2026-06-09T17:17:47.870
Link: CVE-2026-49841
Redhat
No data.
OpenCVE Enrichment
No data.