CVE-2026-45771 Overview
CVE-2026-45771 is a denial-of-service vulnerability in FreeSWITCH, an open-source Software Defined Telecom Stack maintained by SignalWire. The bundled XML parser expands nested <!ENTITY> declarations without enforcing a depth or count bound. A small Document Type Definition (DTD) can describe a body that expands exponentially, the classic "billion laughs" pattern [CWE-776]. The Presence Information Data Format (PIDF) body of a Session Initiation Protocol (SIP) PUBLISH request is parsed before any digest authentication check. This allows an unauthenticated network attacker to force unbounded CPU and memory consumption with a single request. The issue affects all FreeSWITCH releases prior to version 1.11.0.
Critical Impact
An unauthenticated remote attacker can exhaust CPU and memory on a FreeSWITCH instance with a single crafted SIP PUBLISH request, disrupting voice services.
Affected Products
- FreeSWITCH versions prior to 1.11.0
- Deployments exposing SIP PUBLISH endpoints to untrusted networks
- Telecom infrastructure built on the FreeSWITCH stack
Discovery Timeline
- 2026-06-09 - CVE-2026-45771 published to the National Vulnerability Database
- 2026-06-10 - Last updated in NVD database
Technical Details for CVE-2026-45771
Vulnerability Analysis
The flaw resides in the XML parser bundled with FreeSWITCH. The parser processes inline DTDs and expands entity references recursively. It does not cap the recursion depth, the number of entity expansions, or the total expanded size. An attacker submits a SIP PUBLISH message whose PIDF body contains nested <!ENTITY> declarations. Each entity references the previous one multiple times, producing exponential expansion. Parsing a payload of a few kilobytes can produce gigabytes of in-memory output. The worker thread handling the request consumes all available CPU and memory, blocking legitimate signaling. Because the PIDF body is parsed before digest authentication is validated, no credentials or prior session are required.
Root Cause
The root cause is improper restriction of recursive entity references in DTDs, tracked as [CWE-776]. The parser lacks the entity-expansion limits that hardened XML libraries enforce by default. Combined with parsing untrusted bodies prior to authentication, the weakness becomes remotely reachable.
Attack Vector
The attack is delivered over the network. An attacker sends a single SIP PUBLISH request to a listening FreeSWITCH instance. The request carries a PIDF XML body with a billion-laughs DTD. No authentication, user interaction, or prior knowledge of the target's configuration is required. Successful exploitation produces a denial-of-service condition on the telephony service. See the GitHub Security Advisory GHSA-5vjg-pv56-vg4c for additional detail.
No verified public proof-of-concept code is available at the time of writing. The vulnerability mechanism follows the well-documented XML entity expansion class of attacks against parsers that do not bound recursive references.
Detection Methods for CVE-2026-45771
Indicators of Compromise
- Inbound SIP PUBLISH requests containing <!DOCTYPE> declarations with nested <!ENTITY> definitions in the PIDF body
- Sudden spikes in FreeSWITCH process CPU and resident memory correlated with a small number of incoming SIP messages
- FreeSWITCH worker threads stalled in XML parsing routines, observable via stack sampling or perf
- Service unavailability or registration timeouts on otherwise lightly loaded instances
Detection Strategies
- Inspect SIP traffic at the session border controller for PUBLISH bodies containing recursive entity declarations, and alert on any DTD found inside a PIDF payload.
- Correlate FreeSWITCH process resource metrics with inbound SIP message rates to identify low-volume, high-impact requests.
- Enable verbose SIP transaction logging temporarily and review PUBLISH events that precede resource exhaustion.
Monitoring Recommendations
- Track CPU utilization, resident set size, and thread state for the freeswitch process and alert on sustained anomalies.
- Monitor SIP PUBLISH request rates per source IP and flag senders that submit oversized or DTD-bearing PIDF bodies.
- Forward SIP proxy and FreeSWITCH logs to a centralized analytics platform for cross-source correlation.
How to Mitigate CVE-2026-45771
Immediate Actions Required
- Upgrade FreeSWITCH to version 1.11.0 or later, which contains the official fix.
- Restrict SIP signaling exposure to trusted networks or place FreeSWITCH behind a session border controller that validates PIDF bodies.
- Rate-limit SIP PUBLISH requests per source address at the network edge until patching is complete.
- Review FreeSWITCH host capacity controls so a single runaway worker cannot starve the host operating system.
Patch Information
SignalWire released the fix in FreeSWITCH v1.11.0. Operators should review the release notes and apply the upgrade across all FreeSWITCH nodes. The vendor advisory is published as GHSA-5vjg-pv56-vg4c.
Workarounds
- Block or drop SIP PUBLISH requests from untrusted sources at the firewall or session border controller until the upgrade is applied.
- Filter PIDF bodies that contain <!DOCTYPE> or <!ENTITY> declarations at an upstream proxy.
- Apply operating system resource limits (cgroups, ulimit) to the FreeSWITCH service to contain memory and CPU exhaustion.
# Example: cap FreeSWITCH memory and CPU via systemd as a defense-in-depth control
# /etc/systemd/system/freeswitch.service.d/limits.conf
[Service]
MemoryMax=4G
CPUQuota=200%
TasksMax=4096
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
