{"id":"CVE-2026-116573","kind":"vulnerability","aliases":["CVE-2026-116573"],"related":[],"title":"FreeSWITCH: oversized SIP header overflows buffer and crashes calls","description":"FreeSWITCH is an open-source software telecommunications platform. From 1.10.0 until 1.11.1, a stack-based buffer overflow in  mod_sofia  when generating dialog-event notifications. A peer can establish a dialog with an excessively long SIP To-header user part and subsequently subscribe to that entity’s dialog events, causing the stored value to overflow a fixed-size stack buffer. Exploitation requires presence or shared-appearance management to be enabled and normally requires valid profile credentials, unless subscription authentication is disabled. The overflow can terminate the FreeSWITCH process and all active calls. This vulnerability is fixed in version 1.11.2.","summary":"FreeSWITCH's mod_sofia module has a stack-based buffer overflow when it builds dialog-event notifications for SIP subscriptions. A peer that sends an overly long SIP To-header user part and then subscribes can overflow the buffer, which terminates the FreeSWITCH process and all active calls.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["freeswitch","runtime","sip","telecom","voip"],"not_affected_if":["auth-required","presence-disabled","version-outside-1.10.0-1.11.1"],"how_to_check":"- Check the FreeSWITCH version with `fs_cli -x version` and look for a version from 1.10.0 up to 1.11.1.\n- Check whether presence or shared-appearance (dialog-event) subscriptions are enabled in mod_sofia configuration.\n- Check whether subscription authentication is disabled in the SIP profile.","fix":"- FreeSWITCH: upgrade to `1.11.2`","status":"open","published_at":"2026-11-05T19:17:10+00:00","first_seen_at":"2026-11-05T19:40:35+00:00","triaged_at":"2026-11-05T19:43:24+00:00","updated_at":"2026-11-05T19:43:24+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-05T19:43:24Z","model":"claude-haiku-5-5","output":{"fix":"- FreeSWITCH: upgrade to `1.11.2`","reach":"network","title":"FreeSWITCH: oversized SIP header overflows buffer and crashes calls","impact":"high","summary":"FreeSWITCH's mod_sofia module has a stack-based buffer overflow when it builds dialog-event notifications for SIP subscriptions. A peer that sends an overly long SIP To-header user part and then subscribes can overflow the buffer, which terminates the FreeSWITCH process and all active calls.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["freeswitch","voip","sip","telecom"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"process crash takes down all active calls; code execution not stated","analyst_note":"","how_to_check":"- Check the FreeSWITCH version with `fs_cli -x version` and look for a version from 1.10.0 up to 1.11.1.\n- Check whether presence or shared-appearance (dialog-event) subscriptions are enabled in mod_sofia configuration.\n- Check whether subscription authentication is disabled in the SIP profile.","plain_action":"","needs_analyst":false,"not_affected_if":["version-outside-1.10.0-1.11.1","presence-disabled","auth-required"],"who_is_affected":"Only FreeSWITCH servers running versions from 1.10.0 through 1.11.1 with presence or shared-appearance management enabled are exposed. Exploitation normally needs valid SIP profile credentials, unless subscription authentication is disabled, in which case a peer can trigger it without credentials. Systems on other versions or without presence features can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000751,"input_tokens":4378,"output_tokens":627,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116573':12A,15A '-2026':11A,14A '1.10.0':82C '1.11.1':84C '1.11.2':176C 'activ':70B,168C 'appear':143C 'authent':156C 'base':30B,88C 'buffer':6A,31B,62B,89C,136C 'build':35B 'call':9A,71B,169C 'caus':125C 'crash':8A 'credenti':153C 'cve':10A,13A 'dialog':37B,97C,105C,123C 'dialog-ev':36B,96C 'disabl':158C 'enabl':147C 'entiti':121C 'establish':103C 'event':38B,98C,124C 'excess':108C 'exploit':137C 'fix':133C,173C 'fixed-s':132C 'freeswitch':1A,16B,21B,66B,72C,164C 'generat':95C 'header':4A,53B,113C 'long':49B,109C 'manag':144C 'mod':23B,92C 'modul':25B 'normal':149C 'notif':39B,99C 'open':76C 'open-sourc':75C 'over':48B 'overflow':5A,32B,60B,90C,130C,160C 'overs':2A 'part':55B,115C 'peer':44B,101C 'platform':80C 'presenc':139C 'process':67B,165C 'profil':152C 'requir':138C,150C 'runtim':17B 'send':46B 'share':142C 'shared-appear':141C 'sip':3A,18B,41B,50B,110C 'size':134C 'sofia':24B,93C 'softwar':78C 'sourc':77C 'stack':29B,87C,135C 'stack-bas':28B,86C 'store':127C 'subscrib':58B,118C 'subscript':42B,155C 'subsequ':117C 'telecom':19B 'telecommun':79C 'termin':64B,162C 'to-head':51B,111C 'unless':154C 'user':54B,114C 'valid':151C 'valu':128C 'version':175C 'voip':20B 'vulner':171C","nicknames":[],"mitigations":[],"who_affected":"Only FreeSWITCH servers running versions from 1.10.0 through 1.11.1 with presence or shared-appearance management enabled are exposed. Exploitation normally needs valid SIP profile credentials, unless subscription authentication is disabled, in which case a peer can trigger it without credentials. Systems on other versions or without presence features can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["freeswitch","medium","runtime","sip","telecom","voip"],"campaign_type":null,"first_public_at":"2026-10-26T21:10:40+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116573","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116573","severity":null,"published_at":"2026-11-05T19:17:10+00:00","modified_at":"2026-11-05T19:17:10+00:00","first_seen_at":"2026-11-05T19:40:35+00:00","fetched_at":"2026-11-05T19:40:35+00:00","note":null}],"documents":[{"id":79175,"url":"https://github.com/signalwire/freeswitch/commit/49f39c074a5bf81c754619e37ec9e39f2407101f","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":79176,"url":"https://github.com/signalwire/freeswitch/releases/tag/v1.11.2","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":79177,"url":"https://github.com/signalwire/freeswitch/security/advisories/GHSA-6368-jw63-r8g2","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-26T21:10:40+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}