CVE-2026-49842: 
FreeSWITCH vulnerability analysis and mitigation

CVE-2026-49842 is a pre-authentication bandwidth amplification vulnerability in FreeSWITCH's mod_verto module, classified as Uncontrolled Resource Consumption (CWE-400). Prior to version 1.11.1, an unauthenticated attacker can send a short WebSocket request to trigger the server into writing up to ~20 GB of data per request, causing a denial-of-service condition. All FreeSWITCH deployments with a mod_verto WebSocket listener running versions ≤ 1.11.0 are affected. The vulnerability was published on June 9, 2026, and patched in version 1.11.1 released May 26, 2026. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Red Hat CVE).

The root cause lies in mod_verto's WebSocket frame loop, which intercepts #-prefixed speed-test protocol messages (#SPU, #SPB, #SPE) before performing any authentication check (CWE-400). The declared payload size in the #SPU frame was parsed using atoi(), which only rejected non-positive values, allowing an unauthenticated peer to specify up to INT_MAX bytes. The server then responded by writing approximately size * 10 bytes back to the requester during the download phase — potentially ~20 GB per request — from a very short inbound request, creating strong outbound bandwidth amplification. The speed-test branch is hardwired unconditionally into the WebSocket frame loop and is not gated by any profile parameter; TLS does not mitigate the issue because the amplified write occurs after transport termination (GitHub Advisory).

A single unauthenticated WebSocket request can force the FreeSWITCH server to write tens of gigabytes back to the requester, saturating the server's outbound link capacity and exhausting socket and thread resources. Multiple concurrent requests can trivially deny service to all legitimate users on the same listener, disrupting VoIP and telecom services. There is no confidentiality or integrity impact; the vulnerability is purely an availability threat affecting any deployment with an exposed mod_verto WebSocket listener on default ports 8081 (plaintext) or 8082 (TLS) (GitHub Advisory).

No public exploit code or in-the-wild exploitation has been reported as of the time of disclosure. The vulnerability requires only network access to the mod_verto WebSocket listener — no credentials, prior login, or user interaction are needed, making it trivially exploitable by any unauthenticated attacker with network reach. The EPSS score is 0.00054 (low probability of near-term exploitation), and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (GitHub Advisory, Red Hat CVE).

1. Reconnaissance: Identify internet-facing FreeSWITCH instances with mod_verto enabled using tools like Shodan or Censys, targeting default WebSocket ports 8081 (plaintext) or 8082 (TLS).
2. Establish WebSocket connection: Open a WebSocket connection to the target's mod_verto listener without providing any credentials.
3. Send malicious #SPU frame: Transmit a #SPU frame with a very large declared payload size (up to INT_MAX, e.g., #SPU2147483647) — this is a short request of only a few bytes.
4. Trigger amplified response: The server parses the size with atoi(), accepts the large value, and begins writing approximately size * 10 bytes (~20 GB) back over the connection during the download phase.
5. Repeat for amplified DoS: Open multiple concurrent WebSocket connections and repeat the #SPU request to saturate the server's outbound bandwidth and exhaust socket/thread resources, denying service to legitimate users (GitHub Advisory).

• Network: Unusually high outbound bandwidth from the FreeSWITCH server on ports 8081 or 8082; large data transfers to a single or small set of external IP addresses; multiple concurrent WebSocket connections from the same or different source IPs sending minimal inbound data.
• Logs: FreeSWITCH mod_verto logs showing repeated #SPU frames with very large size values from unauthenticated sessions; log entries indicating high-volume write operations on WebSocket connections prior to any authentication event.
• Process/System: Elevated CPU and memory usage by the FreeSWITCH process; thread pool exhaustion or socket resource depletion visible in system monitoring; network interface saturation on the FreeSWITCH host (GitHub Advisory).

The primary remediation is to upgrade FreeSWITCH to version 1.11.1 or later, which gates the #-prefixed speed-test branch behind an authenticated session check and caps the declared size at 10 MiB using strtol() instead of the unbounded atoi(). As immediate workarounds, administrators should restrict the mod_verto WebSocket listener (ports 8081/8082) to trusted networks via firewall rules or by binding to a non-public address, or disable mod_verto entirely if it is not in use. SignalWire strongly encourages all users to upgrade to v1.11.1 as soon as possible (GitHub Advisory, FreeSWITCH v1.11.1).

The vulnerability was discovered and reported by security researcher Adam Bedard (credited as CaffinatedSquirrel-OG in the GitHub advisory). SignalWire published the advisory on June 3, 2026, and released the patch (v1.11.1) on May 26, 2026, describing it as an "important release containing critical security fixes." No significant broader media coverage or notable community commentary beyond the official advisory has been identified (GitHub Advisory, FreeSWITCH v1.11.1).