Vulnerabilities

TI-2026-74149 CVE-2026-110658 · GHSA-9vj3-xq9j-5vq6

Out-of-bounds read in Sofia-SIP MIME parser allows remote crashes

HIGH 70

Sofia-SIP through 1.13.18 contains a heap out-of-bounds read vulnerability in msg_multipart_parse() that allows unauthenticated remote attackers to crash the process by sending oversized MIME boundaries.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00674 Published 2026-10-14 No fix listed CWE-125

TI-2026-36752 CVE-2026-49848

FreeSWITCH: Pre-authentication `userVariables` injection in `mod_verto`

LOW 19

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00172 Published 2026-06-09 Fixed in 1.11.1 CWE-287

TI-2026-36751 CVE-2026-49847

FreeSWITCH: Stack overflow in bundled cJSON parser via deeply nested JSON

LOW 39

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00414 Published 2026-06-09 Fixed in 1.11.1 CWE-674

TI-2026-36747 CVE-2026-49843

FreeSWITCH: Pre-authentication session eviction via attacker-chosen `sessid` in `mod_verto`

LOW 30

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00284 Published 2026-06-09 Fixed in 1.11.1 CWE-287

TI-2026-36746 CVE-2026-49842

FreeSWITCH: Pre-authentication bandwidth amplification via `mod_verto` speed-test frames

LOW 39

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00449 Published 2026-06-09 Fixed in 1.11.1 CWE-400

TI-2026-36745 CVE-2026-49841

FreeSWITCH: Pre-authentication heap buffer overflow in `mod_verto` HTTP POST body read

MEDIUM 49

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00394 Published 2026-06-09 Fixed in 1.11.1 CWE-122

TI-2026-36744 CVE-2026-49840

FreeSWITCH: Pre-authentication heap buffer overflow in libesl `Content-Length` parsing

MEDIUM 45

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.0031 Published 2026-06-09 Fixed in 1.11.1 CWE-122

TI-2026-36629 CVE-2026-49475

FreeSWITCH: Out-of-bounds memory access in core STUN attribute parsing

LOW 39

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00278 Published 2026-06-09 Fixed in 1.11.0 CWE-125

TI-2026-36627 CVE-2026-49472

FreeSWITCH includes a vulnerable function, PREFIX(prologTok)() from libexpat

LOW 23

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware.

CVSS 3.1MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00223 Published 2026-06-09 Fixed in 1.11.0 CWE-116

TI-2026-33508 CVE-2026-45771

Freeswitch Denial-of-Service in SIP PUBLISH Requests via XML Entity Expansion

LOW 39

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00343 Published 2026-06-09 Fixed in 1.11.0 CWE-776

TI-2023-28097 CVE-2023-51443

FreeSWITCH susceptible to Denial of Service via DTLS Hello packets during call initiation

HIGH 72

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01485 Published 2023-12-27 Fixed in 1.10.11 CWE-703

TI-2023-20909 CVE-2023-40019

Resource allocation without limits in signalwire freeswitch

HIGH 72

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00909 Published 2023-09-15 Fixed in 1.10.10 CWE-770

TI-2023-20908 CVE-2023-40018

FreeSWITCH allows remote users to trigger out of bounds write by offering an ICE candidate with unknown component ID

HIGH 72

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00994 Published 2023-09-15 Fixed in 1.10.10 CWE-787

TI-2023-15601 CVE-2023-32307

heap-over-flow and integer-overflow in sofia-sip

HIGH 72

Sofia-SIP is an open-source SIP User-Agent library, compliant with the IETF RFC3261 specification.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01056 Published 2023-05-26 Fixed in 1.13.15 CWE-122

TI-2023-08915 CVE-2023-22741

heap-over-flow in stun_parse_attribute in sofia-sip

HIGH 82

Sofia-SIP is an open-source SIP User-Agent library, compliant with the IETF RFC3261 specification.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02482 Published 2023-01-19 Fixed in 1.13.11 CWE-120

TI-2022-13049 CVE-2022-31003

Heap-based Buffer Overflow and Out-of-bounds Write in Sofia-SIP

HIGH 81

Sofia-SIP is an open-source Session Initiation Protocol (SIP) User-Agent library.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.04107 Published 2022-05-31 Fixed in 1.13.8 CWE-122

TI-2022-13048 CVE-2022-31002

Out-of-bounds Read in Sofia-SIP

HIGH 72

Sofia-SIP is an open-source Session Initiation Protocol (SIP) User-Agent library.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01925 Published 2022-05-31 Fixed in 1.13.8 CWE-125

TI-2022-13047 CVE-2022-31001

Out-of-bounds Read in Sofia-SIP

LOW 37

Sofia-SIP is an open-source Session Initiation Protocol (SIP) User-Agent library.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0222 Published 2022-05-31 Fixed in 1.13.8 CWE-125

TI-2021-17997 CVE-2021-41158

FreeSWITCH vulnerable to SIP digest leak for configured gateways

LOW 34

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00825 Published 2021-10-26 Fixed in 1.10.7 CWE-200

TI-2021-17996 CVE-2021-41157

FreeSWITCH does not authenticate SIP SUBSCRIBE requests by default

LOW 27

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01698 Published 2021-10-26 Fixed in 1.10.6 CWE-287

TI-2021-17946 CVE-2021-41105

FreeSWITCH susceptible to Denial of Service via invalid SRTP packets

LOW 38

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02521 Published 2021-10-25 Fixed in 1.10.7 CWE-20

TI-2021-17984 CVE-2021-41145

FreeSWITCH susceptible to Denial of Service via SIP flooding

MEDIUM 41

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.01651 Published 2021-10-25 Fixed in 1.10.7 CWE-400

TI-2021-15499 CVE-2021-37624

FreeSWITCH does not authenticate SIP MESSAGE requests, leading to spam and message spoofing

LOW 39

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03784 Published 2021-10-25 Fixed in 1.10.7 CWE-287

TI-2019-14041 CVE-2019-19492 · GHSA-24cv-mgp7-4xjv

FreeSWITCH 1.6.10 through 1.10.1 has a default password in event_socket.conf.xml.

HIGH 65

FreeSWITCH 1.6.10 through 1.10.1 has a default password in event_socket.conf.xml.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.29448 Published 2019-12-02 No fix listed CWE-798

TI-2018-14107 CVE-2018-19911 · GHSA-j9vc-vw64-7f9w

FreeSWITCH through 1.8.2, when mod_xml_rpc is enabled, allows remote attackers to execute…

LOW 38

FreeSWITCH through 1.8.2, when mod_xml_rpc is enabled, allows remote attackers to execute arbitrary commands via the api/system or txtapi/system (or api/bg_system or txtapi/bg_system) query string on TCP port 8080, as de…

CVSS 3.0HIGH 7.5 Network No auth User interaction EPSS 0.02696 Published 2018-12-06 No fix listed CWE-352

Vulnerabilities

Filters