CVE-2026-116570 · Runtime
NO FIX YET · SEE WHAT TO DO
FreeSWITCH before 1.11.2 overflows a stack buffer in http_directory_auth() when a configured directory credential is longer than 57 characters. An unauthenticated client who names an existing directory user on an exposed mod_xml_rpc HTTP listener can crash FreeSWITCH and end all active calls; remote code execution has not been demonstrated.
first public Oct 26, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Systems running FreeSWITCH before 1.11.2 are exposed only if mod_xml_rpc is loaded and its HTTP listener is reachable, and a directory user has a long configured credential. The stock configuration does not load mod_xml_rpc, so default installs can skip this. Teams running FreeSWITCH as a telephony backend on exposed networks should check first.
Not affected if default-config, listener-not-exposed, mod-xml-rpc-not-loaded, version-1.11.2-or-later
Who cares freeswitch, self-hosted, telephony, voip
fs_cli -x 'version' and see whether it is below 1.11.2.mod_xml_rpc is loaded in the modules configuration (modules.conf.xml) and whether its HTTP listener is reachable from outside the network.1.11.2.FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, http_directory_auth() rebuilt an expected user@domain:password credential and base64-encoded it into an 80-byte buffer using an encoder without an output-length argument. A configured credential longer than 57 characters overflowed the stack before the supplied HTTP Basic password was compared. An unauthenticated client only needed to name an existing directory user on an exposed mod_xml_rpc HTTP listener; the module is built but not loaded by the stock configuration. The overflow can corrupt the stack and crash FreeSWITCH, ending every active call, although the overrun bytes come from the configured credential and remote code execution has not been demonstrated. This issue is fixed in version 1.11.2.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.