CVE-2026-49841: FreeSWITCH: pre-authentication heap buffer overflow in mod_verto HTTP POST handling

Overview

CVE-2026-49841 is a heap-based buffer overflow (CWE-122) in the HTTP request handler of the mod_verto module in FreeSWITCH. According to the record, the handler allocates a fixed 2 MiB buffer for a form-urlencoded POST body but reads up to the Content-Length value, which can be just under 10 MiB. The advisory describes the read as occurring before HTTP basic authentication is checked.

Impact

• The record describes an attacker-controlled heap overflow of up to about 8 MiB.
• The GitHub-sourced CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, with a score of 9.8 (critical). This means no privileges or user interaction are required over the network, with high confidentiality, integrity and availability impact as scored.
• The SSVC data in the record lists technical impact as total and automatable as yes.

Affected products and versions

The record lists two affected product entries, both limited to versions before 1.11.1:

• Freeswitch Freeswitch: before 1.11.1
• Signalwire Freeswitch: before 1.11.1

The record's fixes list is empty, but the description and the release reference both point to 1.11.1 as the patched version. Versions on other branches are not described in the available data.

Exploitation status

The CISA KEV catalogue does not list this CVE in the record, so no active exploitation is confirmed by that source. No confirmed exploitation appears in the sources consulted. The EPSS probability in the record is 0.00605 (percentile 0.48307), and the SSVC exploitation field is none. These values describe likelihood estimates and do not confirm attacks.

Remediation and mitigation

• Upgrade FreeSWITCH to 1.11.1 or later, as stated in the vendor's release reference.
• Until the upgrade is complete, restrict access to the mod_verto HTTP interface to trusted networks, for example through firewall rules or network segmentation, since the flaw is described as reachable before authentication.
• Review whether mod_verto is needed in each deployment and disable it where it is not used.

Detection guidance

• Inventory all FreeSWITCH instances and their versions, and flag any running a version before 1.11.1.
• Monitor HTTP traffic to the mod_verto interface for unusually large POST bodies and for processes or service crashes on the FreeSWITCH host, as indicators that warrant investigation.
• Keep logs of inbound HTTP requests to the telephony platform for correlation during incident review.

Limitations of the available information

The record does not give technical details beyond the description, and it does not state the exact conditions needed for exploitation in every configuration. The fixes list is empty, so the patched version is taken from the description and the release reference. Whether vendor backports exist for older branches is unknown from the sources consulted.

Frequently asked questions

What is CVE-2026-49841?

It is a heap-based buffer overflow in the mod_verto HTTP request handler of FreeSWITCH, where the POST body read is bounded by Content-Length rather than the 2 MiB buffer size.

Which versions are affected?

The record lists Freeswitch Freeswitch and Signalwire Freeswitch as affected before 1.11.1.

Is the flaw exploitable before authentication?

The description states the overflow occurs before the HTTP basic-auth check runs, so the record indicates it is reachable pre-authentication.

Is this vulnerability being actively exploited?

The record shows it is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.

What should administrators do?

Upgrade to 1.11.1 or later, restrict access to the mod_verto HTTP interface, and inventory FreeSWITCH instances for versions before 1.11.1.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.