High severity · published Jun 9, 2026
CVE-2026-49842
FreeSWITCH: Pre-authentication bandwidth amplification via `mod_verto` speed-test frames
7.5
CVSS
0.4%
EPSS
No
On KEV
Description
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.11.1, mod_verto's WebSocket frame loop intercepts a #-prefixed speed-test protocol (#SPU / #SPB / #SPE) before any authentication check. The declared payload size in #SPU was parsed with atoi() and only rejected non-positive values, so an unauthenticated peer could request up to INT_MAX bytes. The server then wrote roughly size * 10 bytes back during the download phase, on the order of 20 GB per request, yielding strong outbound bandwidth amplification from a short request. This issue has been patched in version 1.11.1.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 39% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FR
freeswitch · signalwire
< 1.11.1 · source: vendor, NVD
Affected product
FR
freeswitch
signalwire
More from freeswitch
9.8
CVE-2026-49841
FreeSWITCH: Pre-authentication heap buffer overflow in `mod_verto` HTTP POST body read
9.1
CVE-2026-49840
FreeSWITCH: Pre-authentication heap buffer overflow in libesl `Content-Length` parsing
7.5
CVE-2026-49847
FreeSWITCH: Stack overflow in bundled cJSON parser via deeply nested JSON
7.5
CVE-2026-49475
FreeSWITCH: Out-of-bounds memory access in core STUN attribute parsing
7.5
CVE-2026-45771
Freeswitch Denial-of-Service in SIP PUBLISH Requests via XML Entity Expansion