CVE-2026-49841

The HTTP POST request handling procedure in the mod_verto module allocates a fixed buffer of 2 MiB size to store the content of requests of type application/x-www-form-urlencoded. At the same time, it accepts a Content-Length header value reaching up to nearly 10 MiB. The loop reading data from the request body is limited by the Content-Length value rather than the buffer size, allowing an attacker to perform a controlled heap buffer overflow (heap overflow) of up to approximately 8 MiB. Importantly, the overflow occurs before any HTTP Basic Auth authentication check is performed, so the exploit does not require any credentials.

A remote, unauthenticated attacker can achieve arbitrary code execution (RCE), disclosure of sensitive data, or service unavailability through a controlled heap buffer overflow.

FreeSWITCH should be updated to version 1.11.1, where the vulnerability has been fixed. The patch is available in the official project repository: https://github.com/signalwire/freeswitch/releases/tag/v1.11.1. Until an update is applied, it is recommended to restrict network access to the HTTP interface of the mod_verto module using a firewall or disable this module if it is not required.

FreeSWITCH versions prior to 1.11.1 with the active mod_verto module and an accessible HTTP interface.