CVE-2026-49840CWE-122CWE-195CWE-20CWE-787

FreeSWITCH: Pre-authentication heap buffer overflow in libesl `Content-Length` parsing

Critical · published June 9, 2026

CVSS v3.1
9.1
EPSS
0%
Percentile
40.8
In the wild
Unconfirmed
What it is

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.11.1, esl_recv_event() parses Content-Length with atol() and passes the result straight to malloc(len + 1) with no sign or magnitude check. A malicious or man-in-the-middle ESL peer can send a frame with a negative Content-Length to corrupt the heap of, or crash, any process linked against libesl, before the client has authenticated to that peer. This issue has been patched in version 1.11.1.

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00485 · 40.8th percentile
Weaknesses
CWE-122 · Heap-based Buffer Overflow; CWE-195 · Signed to Unsigned Conversion Error; CWE-20 · Improper Input Validation; CWE-787 · Out-of-bounds Write
Published
2026-06-09T16:00Z
EPSS history
Timeline
  • 09 JUN 16:00Z
    FreeSWITCH: Pre-authentication heap buffer overflow in libesl `Content-Length` parsing
    cvelistv5