CVE-2026-116787: FreeSWITCH: Pre-authentication process termination in the Event Socket via an unbounded Content-Length
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, modeventsocket used an unauthenticated Content-Length value directly as the allocation size for an Event Socket message body. Negative or extremely large values could overflow the terminator calculation or force an allocation failure through a helper that aborts the FreeSWITCH process. The header is parsed before the Event Socket password, so any host admitted by apply-inbound-acl can trigger termination with its first packet; the default loopback ACL limits ordinary installations to local clients. The outbound socket dialplan path is also affected when FreeSWITCH connects to a hostile application server, and process termination drops every active call until the service is restarted. This issue is fixed in version 1.11.2.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeSWITCHto a version that resolves this vulnerability.Fixed in 1.11.2
Event History
Frequently Asked Questions
Which systems are most exposed to unauthenticated inbound exploitation?
Any FreeSWITCH host that admits an attacker-controlled source through apply-inbound-acl is exposed because the malformed Content-Length is processed before the Event Socket password. Ordinary default installations limit this ACL to loopback clients, so remote exposure generally depends on ACL configuration.
Can an attacker exploit this without Event Socket credentials?
Yes. A host permitted by apply-inbound-acl can trigger the failure in its first Event Socket packet, before password authentication occurs.
Are outbound Event Socket deployments affected too?
Yes. The outbound socket dialplan path is affected when FreeSWITCH connects to a hostile application server. A malicious outbound peer can cause FreeSWITCH to terminate.
What is the operational impact of a successful attack?
The FreeSWITCH process terminates, dropping every active call. Service remains unavailable until the process is restarted.
What version fixes the issue?
Upgrade to FreeSWITCH 1.11.2. If an immediate upgrade is not possible, restrict apply-inbound-acl so untrusted hosts cannot reach the Event Socket and avoid connecting outbound sockets to untrusted application servers.