CVE-2026-116573 · Runtime
NO FIX YET · SEE WHAT TO DO
FreeSWITCH's mod_sofia module has a stack-based buffer overflow when it builds dialog-event notifications for SIP subscriptions. A peer that sends an overly long SIP To-header user part and then subscribes can overflow the buffer, which terminates the FreeSWITCH process and all active calls.
first public Oct 26, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Only FreeSWITCH servers running versions from 1.10.0 through 1.11.1 with presence or shared-appearance management enabled are exposed. Exploitation normally needs valid SIP profile credentials, unless subscription authentication is disabled, in which case a peer can trigger it without credentials. Systems on other versions or without presence features can skip it.
Not affected if auth-required, presence-disabled, version-outside-1.10.0-1.11.1
Who cares freeswitch, sip, telecom, voip
fs_cli -x version and look for a version from 1.10.0 up to 1.11.1.1.11.2FreeSWITCH is an open-source software telecommunications platform. From 1.10.0 until 1.11.1, a stack-based buffer overflow in mod_sofia when generating dialog-event notifications. A peer can establish a dialog with an excessively long SIP To-header user part and subsequently subscribe to that entity’s dialog events, causing the stored value to overflow a fixed-size stack buffer. Exploitation requires presence or shared-appearance management to be enabled and normally requires valid profile credentials, unless subscription authentication is disabled. The overflow can terminate the FreeSWITCH process and all active calls. This vulnerability is fixed in version 1.11.2.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.