CVE-2026-49847

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.11.1, a single unauthenticated WebSocket frame containing a deeply nested JSON document crashes the FreeSWITCH process via stack overflow, terminating all calls and sessions on the host. The recursion drives the worker thread's stack pointer into the stack guard page, raising SIGSEGV from the kernel before any usable write primitive develops. This issue has been patched in version 1.11.1.

• CWE-674

• https://github.com/signalwire/freeswitch/releases/tag/v1.11.1Release Notes
• https://github.com/signalwire/freeswitch/security/advisories/GHSA-2v74-pcgh-75wgThird Party Advisory

Published

Jun 9, 2026

Last Modified

Jul 23, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-4984The Twilio integration webhook handler accepts any POST requ…8.2
• CVE-2026-49840FreeSWITCH is a Software Defined Telecom Stack enabling the …9.1
• CVE-2026-49841FreeSWITCH is a Software Defined Telecom Stack enabling the …9.8
• CVE-2026-49842FreeSWITCH is a Software Defined Telecom Stack enabling the …7.5
• CVE-2026-49843FreeSWITCH is a Software Defined Telecom Stack enabling the …5.3
• CVE-2026-49844Improper encoding of non-finite floating-point values during…5.9
• CVE-2026-49848FreeSWITCH is a Software Defined Telecom Stack enabling the …4.3
• CVE-2026-4985A vulnerability was identified in dloebl CGIF up to 0.5.2. T…5.3
• CVE-2026-49851Mistune is a Python Markdown parser with renderers and plugi…8.7
• CVE-2026-49852joserfc is a Python library that provides an implementation …8.7
• CVE-2026-49853Tornado is a Python web framework and asynchronous networkin…7.7
• CVE-2026-49854Tornado is a Python web framework and asynchronous networkin…5.3