CVE-2026-49847: 
FreeSWITCH vulnerability analysis and mitigation

CVE-2026-49847 is a stack overflow vulnerability in FreeSWITCH's bundled cJSON parser that allows an unauthenticated remote attacker to crash the FreeSWITCH process by sending a single WebSocket frame containing a deeply nested JSON document. It affects all FreeSWITCH versions prior to 1.11.1 and was published on June 9, 2026. The vulnerability was discovered by security researcher Adam Bedard and patched in FreeSWITCH v1.11.1, released May 26, 2026. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Red Hat CVE).

The root cause is uncontrolled recursion (CWE-674) in the bundled cJSON parser, which uses a recursive descent approach: parse_value calls parse_object/parse_array, each of which recurses back into parse_value for every child element. With the upstream CJSON_NESTING_LIMIT of 1000, a crafted document can drive approximately 1000 nested calls, exhausting the 240 KiB FreeSWITCH worker thread stack (SWITCH_THREAD_STACKSIZE) well before that limit is reached. The critical exposure is in mod_verto's WebSocket frame handler, which calls cJSON_Parse on raw frame data before the authentication gate, meaning any network peer that can reach the listener can trigger the crash. The recursion drives the worker thread's stack pointer into the kernel's stack guard page, raising a SIGSEGV that terminates the entire FreeSWITCH process. The same vulnerable cJSON parser is also linked into FreeSWITCH core and libesl, though the pre-auth verto path represents the broadest unauthenticated attack surface (GitHub Advisory).

Successful exploitation causes an immediate crash of the entire FreeSWITCH process, terminating all active calls and sessions on the affected host — a complete availability loss. Because the SIGSEGV is raised before any usable write primitive develops, there is no known path to code execution, and confidentiality and integrity are not impacted. Any deployment using FreeSWITCH for telephony, WebRTC, or VoIP services would experience a full service outage, and the attack can be repeated to prevent recovery (GitHub Advisory, Red Hat CVE).

No public exploit code or in-the-wild exploitation has been reported as of the time of writing. The EPSS score is 0.0004 (approximately 0.04%), indicating a low current probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the attack requires no authentication, no user interaction, and only network access to the default mod_verto WebSocket listener ports (:8081 plaintext, :8082 TLS), making it trivially exploitable by any attacker with network reach to those ports (GitHub Advisory).

1. Reconnaissance: Identify internet-facing or network-accessible FreeSWITCH instances running versions prior to 1.11.1 with mod_verto enabled. Scan for default WebSocket listener ports :8081 (plaintext) or :8082 (TLS) using tools like Shodan, Censys, or nmap.
2. Craft malicious payload: Construct a deeply nested JSON document (e.g., {"a":{"a":{"a":...}}} repeated to a depth of ~200–1000 levels) that will exhaust the 240 KiB worker thread stack when parsed recursively by cJSON.
3. Establish WebSocket connection: Connect to the target's mod_verto WebSocket endpoint (e.g., ws://<target>:8081 or wss://<target>:8082) using any WebSocket client. No credentials or prior session are required.
4. Send the malicious frame: Transmit the crafted deeply nested JSON document as a single WebSocket frame. The mod_verto frame handler passes the raw payload to cJSON_Parse before any authentication check.
5. Trigger crash: The recursive cJSON parser exhausts the worker thread stack, causing a SIGSEGV from the kernel's stack guard page, which crashes the entire FreeSWITCH process and terminates all active calls and sessions (GitHub Advisory).

• Network: Unexpected or repeated WebSocket connection attempts to FreeSWITCH ports :8081 or :8082 from unknown or untrusted source IPs; short-lived connections that do not complete a normal verto handshake.
• Logs: FreeSWITCH crash logs or core dump files generated around the time of the incident; absence of normal call processing logs following a sudden process termination; OS-level logs (e.g., syslog, journald) recording a SIGSEGV signal for the FreeSWITCH process.
• Process: Unexpected termination of the FreeSWITCH process (freeswitch binary) without a graceful shutdown; automatic restart events from a process supervisor (e.g., systemd, supervisord) indicating repeated crashes.
• File System: Presence of core dump files (e.g., core.<pid>) in the FreeSWITCH working directory or system core dump location following a crash (GitHub Advisory).

The primary fix is to upgrade FreeSWITCH to version 1.11.1 or later, which caps the CJSON_NESTING_LIMIT at 64 via build flags applied to the bundled cJSON sources in both FreeSWITCH core and libesl. This limit is sufficient for all legitimate JSON-RPC payloads used by stock verto clients while preventing stack exhaustion. If immediate upgrade is not possible, two workarounds are available: (1) restrict the mod_verto WebSocket listener to trusted networks using a firewall or by narrowing the bind-local parameter in verto.conf.xml; or (2) disable mod_verto entirely, which stops WebRTC/verto signaling on the host. Note that TLS does not mitigate the vulnerability, as parsing occurs after transport termination (GitHub Advisory, FreeSWITCH v1.11.1 Release).

The FreeSWITCH maintainers (SignalWire) published the security advisory on June 3, 2026, and strongly encouraged all users to upgrade to v1.11.1 immediately, describing it as an "important release containing critical security fixes." The vulnerability was credited to security researcher Adam Bedard. No significant broader media coverage or notable community debate has been identified beyond standard vulnerability database aggregation (GitHub Advisory, FreeSWITCH v1.11.1 Release).