CVE-2026-49840: FreeSWITCH: Pre-authentication heap buffer overflow in libesl `Content-Length` parsing
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.11.1, eslrecvevent() parses Content-Length with atol() and passes the result straight to malloc(len + 1) with no sign or magnitude check. A malicious or man-in-the-middle ESL peer can send a frame with a negative Content-Length to corrupt the heap of, or crash, any process linked against libesl, before the client has authenticated to that peer. This issue has been patched in version 1.11.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeSWITCH (libesl)to a version that resolves this vulnerability.Fixed in 1.11.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-49840?
The severity of CVE-2026-49840 is rated as critical with a score of 9.1.
What does CVE-2026-49840 vulnerability affect?
CVE-2026-49840 affects the FreeSWITCH libesl component due to a pre-authentication heap buffer overflow during Content-Length parsing.
How do I fix CVE-2026-49840?
To fix CVE-2026-49840, upgrade FreeSWITCH to version 1.11.1 or later where the vulnerability is patched.
What is the risk associated with CVE-2026-49840?
CVE-2026-49840 has a risk rating of 66, indicating a high potential for exploitation.
What type of vulnerability is CVE-2026-49840 classified as?
CVE-2026-49840 is classified as an Input Validation vulnerability.