---
id: "CVE-2026-116573"
kind: "vulnerability"
aliases: ["CVE-2026-116573"]
title: "FreeSWITCH: oversized SIP header overflows buffer and crashes calls"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["freeswitch", "runtime", "sip", "telecom", "voip"]
not_affected_if: ["auth-required", "presence-disabled", "version-outside-1.10.0-1.11.1"]
published_at: "2026-11-05T19:17:10+00:00"
first_seen_at: "2026-11-05T19:40:35+00:00"
updated_at: "2026-11-05T19:43:24+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116573", "first_seen_at": "2026-11-05T19:40:35+00:00"}]
exploit_sources: []
---

# FreeSWITCH: oversized SIP header overflows buffer and crashes calls

FreeSWITCH's mod_sofia module has a stack-based buffer overflow when it builds dialog-event notifications for SIP subscriptions. A peer that sends an overly long SIP To-header user part and then subscribes can overflow the buffer, which terminates the FreeSWITCH process and all active calls.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the FreeSWITCH version with `fs_cli -x version` and look for a version from 1.10.0 up to 1.11.1.
- Check whether presence or shared-appearance (dialog-event) subscriptions are enabled in mod_sofia configuration.
- Check whether subscription authentication is disabled in the SIP profile.

## Fix

- FreeSWITCH: upgrade to `1.11.2`

## Timeline

- 2026-11-05T19:40:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116573

## Documents

- [advisory] Vendor advisory: github.com https://github.com/signalwire/freeswitch/security/advisories/GHSA-6368-jw63-r8g2
- [fix] Patch: github.com https://github.com/signalwire/freeswitch/commit/49f39c074a5bf81c754619e37ec9e39f2407101f
- [fix] Release notes: github.com https://github.com/signalwire/freeswitch/releases/tag/v1.11.2

## From the sources

FreeSWITCH is an open-source software telecommunications platform. From 1.10.0 until 1.11.1, a stack-based buffer overflow in  mod_sofia  when generating dialog-event notifications. A peer can establish a dialog with an excessively long SIP To-header user part and subsequently subscribe to that entity’s dialog events, causing the stored value to overflow a fixed-size stack buffer. Exploitation requires presence or shared-appearance management to be enabled and normally requires valid profile credentials, unless subscription authentication is disabled. The overflow can terminate the FreeSWITCH process and all active calls. This vulnerability is fixed in version 1.11.2.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_