CVE-2026-49841: 
FreeSWITCH vulnerability analysis and mitigation

CVE-2026-49841 is a pre-authentication heap buffer overflow vulnerability in FreeSWITCH's mod_verto HTTP POST body handler. The mod_verto module allocates a fixed 2 MiB buffer for application/x-www-form-urlencoded POST bodies but accepts a Content-Length of up to just under 10 MiB; the body-read loop is bounded by Content-Length rather than the buffer size, enabling an attacker-controlled heap overflow of up to ~8 MiB before any HTTP basic-auth check runs. All FreeSWITCH versions prior to 1.11.1 are affected. The vulnerability was published on June 9, 2026, and carries a CVSS v3.1 base score of 9.8 (Critical) (GitHub Advisory, Red Hat CVE).

The root cause is an incorrect buffer size calculation (CWE-131) in the mod_verto HTTP request handler, resulting in a heap-based buffer overflow (CWE-122). When a POST request with Content-Type: application/x-www-form-urlencoded is received, the handler allocates a static 2 MiB heap buffer but then reads up to the full Content-Length (capped just below 10 MiB) into that buffer — every byte beyond 2 MiB overwrites adjacent heap memory with fully attacker-controlled content. Critically, this overflow occurs before the HTTP basic-auth check, meaning no credentials or prior interaction are required. The vulnerability is only reachable on verto profiles that include at least one <vhost> block; the default verto.conf.xml (which has no <vhost>) is not affected out of the box, but any deployment serving a web UI (e.g., Verto Communicator) is in scope (GitHub Advisory).

Successful exploitation can cause reliable denial of service via heap corruption, which is described as trivial to trigger. Depending on heap layout, the overflow may corrupt adjacent allocations whose contents are later reflected in HTTP responses or WebSocket frames, leading to information disclosure. While remote code execution has not been publicly demonstrated, it is considered plausible given the ~8 MiB of fully attacker-controlled heap overflow and the absence of any authentication requirement (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the time of disclosure. The vulnerability is unauthenticated and network-reachable with low attack complexity, making it highly accessible to any attacker with network access to the verto listener (default ports 8081/TCP plaintext and 8082/TCP TLS). TLS does not mitigate the issue, as the overflow occurs in HTTP body parsing after transport termination. The EPSS score is 0.00043 (low probability of near-term exploitation), and the vulnerability does not appear in the CISA KEV catalog (GitHub Advisory, Red Hat CVE).

1. Reconnaissance: Identify internet-facing FreeSWITCH instances with mod_verto enabled and at least one <vhost> configured. Scan for open ports 8081 (plaintext) or 8082 (TLS) using tools like Shodan, Censys, or nmap.
2. Confirm vhost presence: Send a benign HTTP GET request to the target's verto port. A valid HTTP response (rather than a WebSocket-only rejection) indicates a <vhost> is configured and the HTTP handler is active.
3. Craft malicious POST request: Construct an HTTP POST request to the verto listener with Content-Type: application/x-www-form-urlencoded and a Content-Length header set to a value between 2 MiB and just under 10 MiB (e.g., ~9.9 MiB).
4. Send oversized body: Transmit the POST body filled with attacker-controlled content (e.g., shellcode, ROP gadgets, or pattern bytes for heap layout analysis). Every byte beyond the 2 MiB buffer boundary overwrites adjacent heap memory.
5. Trigger impact: Depending on heap layout and attacker goals, this may crash the FreeSWITCH process (DoS), corrupt adjacent heap objects to leak memory contents in subsequent responses (information disclosure), or — if heap layout is favorable — achieve arbitrary code execution (GitHub Advisory).

• Network: Unusually large HTTP POST requests (>2 MiB body) to TCP ports 8081 or 8082 on FreeSWITCH hosts; Content-Length headers in POST requests to the verto endpoint significantly exceeding 2 MiB.
• Logs: FreeSWITCH crash logs or core dumps originating from the mod_verto HTTP handler; repeated connection attempts to the verto port with large POST bodies from a single source IP.
• Process: Unexpected termination or restart of the freeswitch process; crash dumps in the FreeSWITCH working directory (e.g., /tmp/ or the configured core dump path) following HTTP POST activity.
• File System: Presence of core dump files (core.*) in the FreeSWITCH installation directory following exploitation attempts.

Upgrade to FreeSWITCH version 1.11.1 or later, which fixes the heap overflow by sizing the body-buffer allocation to match the request's Content-Length rather than using a fixed 2 MiB buffer (FreeSWITCH v1.11.1). If immediate upgrade is not possible, the following workarounds reduce exposure: (1) restrict the verto listener to trusted networks via firewall rules or by binding it to a non-public interface; (2) remove all <vhost> entries from the verto profile, which disables the HTTP request handler entirely while preserving WebSocket/JSON-RPC functionality; or (3) disable mod_verto outright if it is not in use (GitHub Advisory).

The vulnerability was discovered and reported by security researcher Adam Bedard, with credit also given to analyst CaffinatedSquirrel-OG in the GitHub Security Advisory. The FreeSWITCH maintainers described v1.11.1 as an "important release containing critical security fixes" and strongly encouraged all users to upgrade as soon as possible (FreeSWITCH v1.11.1). Coverage appeared on SecurityOnline.info and was tracked by Red Hat's CVE database, indicating moderate community awareness (Red Hat CVE).