CVE-2026-49842: FreeSWITCH: Pre-authentication bandwidth amplification via `mod_verto` speed-test frames
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.11.1, modverto's WebSocket frame loop intercepts a #-prefixed speed-test protocol (#SPU / #SPB / #SPE) before any authentication check. The declared payload size in #SPU was parsed with atoi() and only rejected non-positive values, so an unauthenticated peer could request up to INTMAX bytes. The server then wrote roughly size 10 bytes back during the download phase, on the order of 20 GB per request, yielding strong outbound bandwidth amplification from a short request. This issue has been patched in version 1.11.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeSWITCH (mod_verto)to a version that resolves this vulnerability.Fixed in 1.11.1 - Remove
Remove
mod_verto (FreeSWITCH)from your environment.If mod_verto is not required, uninstall or disable the mod_verto module to eliminate exposure until systems can be patched.
- Compensating control
Restrict access to mod_verto's WebSocket endpoint to trusted IPs and networks, and apply egress bandwidth limiting / rate-limiting or WAF rules to mitigate outbound amplification until the patch is applied.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-49842?
CVE-2026-49842 has a high severity rating of 7.5.
How do I fix CVE-2026-49842?
To mitigate CVE-2026-49842, upgrade FreeSWITCH to version 1.11.1 or later.
What kind of vulnerability is CVE-2026-49842?
CVE-2026-49842 is a pre-authentication bandwidth amplification vulnerability in FreeSWITCH's mod_verto.
What impact can CVE-2026-49842 have?
CVE-2026-49842 can lead to denial of service due to bandwidth amplification.
Who is affected by CVE-2026-49842?
Anyone using FreeSWITCH versions prior to 1.11.1 with the mod_verto module enabled is affected by CVE-2026-49842.