Freeswitch vulnerabilities

Products

• Freeswitch 21
• Sofia-sip 6

Newest

• freeswitch sofia-sip Sofia-SIP through 1.13.18 Heap Out-of-Bounds Read via msg_multipart_parse CVE-2026-110658 Fix available 6.9 MediumOctober 14, 2026
• freeswitch FreeSWITCH: Pre-authentication `userVariables` injection in `mod_verto` CVE-2026-49848 4.3 MediumJune 9, 2026
• freeswitch FreeSWITCH: Stack overflow in bundled cJSON parser via deeply nested JSON CVE-2026-49847 7.5 HighJune 9, 2026
• freeswitch FreeSWITCH: Pre-authentication session eviction via attacker-chosen `sessid` in `mod_verto` CVE-2026-49843 5.3 MediumJune 9, 2026
• freeswitch FreeSWITCH: Pre-authentication bandwidth amplification via `mod_verto` speed-test frames CVE-2026-49842 7.5 HighJune 9, 2026
• freeswitch FreeSWITCH: Pre-authentication heap buffer overflow in `mod_verto` HTTP POST body read CVE-2026-49841 9.8 CriticalJune 9, 2026
• freeswitch FreeSWITCH: Pre-authentication heap buffer overflow in libesl `Content-Length` parsing CVE-2026-49840 9.1 CriticalJune 9, 2026
• freeswitch FreeSWITCH: Out-of-bounds memory access in core STUN attribute parsing CVE-2026-49475 7.5 HighJune 9, 2026
• freeswitch FreeSWITCH includes a vulnerable function, PREFIX(prologTok)() from libexpat CVE-2026-49472 5.3 MediumJune 9, 2026
• freeswitch Freeswitch Denial-of-Service in SIP PUBLISH Requests via XML Entity Expansion CVE-2026-45771 7.5 HighJune 9, 2026
• freeswitch FreeSWITCH susceptible to Denial of Service via DTLS Hello packets during call initiation CVE-2023-51443 Fix available 7.5 HighDecember 27, 2023
• freeswitch FreeSWITCH allows authorized users to cause a denial of service attack by sending re-INVITE with SDP containing duplicate codec names CVE-2023-40019 7.5 HighSeptember 15, 2023
• freeswitch FreeSWITCH allows remote users to trigger out of bounds write by offering an ICE candidate with unknown component ID CVE-2023-40018 7.5 HighSeptember 15, 2023
• freeswitch sofia-sip, debian linux +1 more heap-over-flow and integer-overflow in sofia-sip CVE-2023-32307 Fix available 7.5 HighMay 26, 2023
• freeswitch sofia-sip heap-over-flow in stun_parse_attribute in sofia-sip CVE-2023-22741 Fix available 9.8 CriticalJanuary 19, 2023
• freeswitch sofia-sip, debian linux +1 more Heap-based Buffer Overflow and Out-of-bounds Write in Sofia-SIP CVE-2022-31003 Fix available 9.1 CriticalMay 31, 2022
• freeswitch sofia-sip, debian linux +1 more Out-of-bounds Read in Sofia-SIP CVE-2022-31002 Fix available 7.5 HighMay 31, 2022
• freeswitch sofia-sip, debian linux +1 more Out-of-bounds Read in Sofia-SIP CVE-2022-31001 Fix available 7.5 HighMay 31, 2022
• freeswitch FreeSWITCH vulnerable to SIP digest leak for configured gateways CVE-2021-41158 Fix available 5.8 MediumOctober 26, 2021
• freeswitch FreeSWITCH does not authenticate SIP SUBSCRIBE requests by default CVE-2021-41157 Fix available 5.3 MediumOctober 26, 2021
• freeswitch FreeSWITCH susceptible to Denial of Service via invalid SRTP packets CVE-2021-41105 Fix available 7.5 HighOctober 25, 2021
• freeswitch FreeSWITCH susceptible to Denial of Service via SIP flooding CVE-2021-41145 Fix available 8.6 HighOctober 25, 2021
• freeswitch FreeSWITCH does not authenticate SIP MESSAGE requests, leading to spam and message spoofing CVE-2021-37624 Public exploitFix available 7.5 HighOctober 25, 2021
• freeswitch FreeSWITCH 1.6.10 through 1.10.1 has a default password in event_socket.conf.xml. CVE-2019-19492 Public exploit EPSS 29.4% 9.8 CriticalDecember 2, 2019
• freeswitch FreeSWITCH through 1.8.2, when mod_xml_rpc is enabled, allows remote attackers to execute... CVE-2018-19911 Public exploit 7.5 HighDecember 6, 2018
• freeswitch Heap-based buffer overflow in the parse_string function in libs/esl/src/esl_json.c in FreeSWITCH... CVE-2015-7392 7.5 HighOctober 5, 2015
• freeswitch Multiple buffer overflows in the switch_perform_substitution function in switch_regex.c in... CVE-2013-2238 Fix available 6.8 MediumSeptember 19, 2013