---
id: "CVE-2026-116781"
kind: "vulnerability"
aliases: ["CVE-2026-116781"]
title: "FreeSWITCH: WebSocket frame handling writes past buffer before authentication"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["freeswitch", "runtime", "self-hosted", "telecom", "voip"]
not_affected_if: ["default-config", "mod-xml-rpc-disabled", "websocket-disabled"]
published_at: "2026-11-05T20:17:45+00:00"
first_seen_at: "2026-11-05T20:40:45+00:00"
updated_at: "2026-11-05T20:43:30+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116781", "first_seen_at": "2026-11-05T20:40:45+00:00"}]
exploit_sources: []
---

# FreeSWITCH: WebSocket frame handling writes past buffer before authentication

FreeSWITCH's WebSocket reader unmasks payload using the wrong length, so a masked frame can write up to 14 bytes past a 64 KiB buffer. An attacker who can reach the endpoint before logging in may corrupt adjacent memory; no crash or data disclosure has been demonstrated.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the FreeSWITCH version with `fs_cli -x version` and compare it to the fixed release.
- Check whether mod_xml_rpc is loaded and its WebSocket endpoint is enabled in the xml_rpc configuration.

## Fix

- FreeSWITCH: upgrade to `1.11.2`.

## Timeline

- 2026-11-05T20:40:45+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116781

## Documents

- [advisory] Vendor advisory: github.com https://github.com/signalwire/freeswitch/security/advisories/GHSA-4cg6-rvh2-cw74
- [fix] Patch: github.com https://github.com/signalwire/freeswitch/commit/fb9f37b9c7869630ee52a3ae87399fbbf99ad74d
- [fix] Release notes: github.com https://github.com/signalwire/freeswitch/releases/tag/v1.11.2

## From the sources

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, ws_read_frame() unmasked a WebSocket payload by iterating wsh->datalen, which included frame headers, while indexing from the payload pointer. A masked frame filling the 64 KiB receive buffer could therefore XOR up to 14 bytes beyond the buffer, and the exact-capacity case also wrote a terminating NUL one byte out of bounds. The flaw is reachable before authentication when mod_xml_rpc and its opt-in WebSocket endpoint are enabled, while both features are disabled in the stock configuration. The writes remain within the same connection handle's adjacent outbound buffer, so neither a process crash nor cross-session disclosure has been demonstrated. This issue is fixed in version 1.11.2.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_