Description

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, mod_event_socket used an unauthenticated Content-Length value directly as the allocation size for an Event Socket message body. Negative or extremely large values could overflow the terminator calculation or force an allocation failure through a helper that aborts the FreeSWITCH process. The header is parsed before the Event Socket password, so any host admitted by apply-inbound-acl can trigger termination with its first packet; the default loopback ACL limits ordinary installations to local clients. The outbound socket dialplan path is also affected when FreeSWITCH connects to a hostile application server, and process termination drops every active call until the service is restarted. This issue is fixed in version 1.11.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-11-05T20:17:46.073Z",
  "pubdate": "2026-11-05T20:17:46.073Z",
  "executiveSummary": "The vulnerability identified in FreeSWITCH, specifically within the mod_event_socket module, is a critical denial of service (DoS) flaw caused by improper input validation of the Content-Length header.\nPrior to version 1.11.2, the module failed to validate the size parameter provided in incoming Event Socket messages before memory allocation, allowing unauthenticated attackers to trigger an application crash.\nThe flaw affects both inbound socket connections, if the host is permitted by the apply-inbound-acl, and outbound socket dialplan paths connected to hostile application servers.\nBy supplying negative or excessively large values, an attacker can force a memory allocation failure that triggers an abort signal, effectively terminating the FreeSWITCH process.\nThe impact is significant as process termination immediately drops all active telecommunications calls, leading to a complete service outage until manual intervention or restart occurs.\nExploitation is trivial for any client allowed by the access control list, as the malicious header is parsed prior to the authentication handshake, bypassing password requirements.\nThe risk is elevated for deployments with exposed ports or those that frequently connect to external, untrusted application servers.",
  "technicalDetails": "The vulnerability resides in the mod_event_socket module of FreeSWITCH. The root cause is an insecure handling of the 'Content-Length' header during the initial phase of an Event Socket communication.\nThe application reads the 'Content-Length' value and passes it directly to internal memory allocation functions without performing boundary checks or sanitizing the input for invalid integers, such as negative values or integers exceeding system-defined limits.\nBecause this parsing logic executes before the authentication process (which requires an Event Socket password), the vulnerability is exploitable by any host that satisfies the 'apply-inbound-acl' criteria. By default, this includes loopback connections, but it remains a critical risk for any instance where the Event Socket is exposed to a broader network range.\nThe exploitation flow proceeds as follows: 1. The attacker initiates a TCP connection to the FreeSWITCH Event Socket port. 2. The attacker sends a malformed header containing a crafted 'Content-Length' field. 3. The mod_event_socket component processes the header and attempts to allocate memory based on the attacker-supplied integer. 4. If the value is negative or mathematically incompatible with the internal terminator calculation, the process encounters an unhandled exception or forces a helper function to trigger a process abort. 5. The FreeSWITCH process exits immediately, resulting in the termination of all ongoing media sessions and signaling transactions.\nAdditionally, the vulnerability extends to the outbound socket dialplan path. If FreeSWITCH is configured to act as an outbound socket client connecting to a malicious application server, the server can return a crafted response containing the malicious 'Content-Length' header, triggering the same abort mechanism within the FreeSWITCH instance.\nThis behavior constitutes a Remote Denial of Service (RDoS) attack, as it does not require authentication or elevated privileges beyond being an allowed peer. The lack of validation on the header value prior to memory allocation represents a failure in robust input handling, specifically regarding integer overflow and memory allocation safety in the context of the Event Socket protocol parser."
}