CVE-2026-49472: FreeSWITCH XXE Vulnerability

CVE-2026-49472 Overview

FreeSWITCH is a software-defined telecom stack that replaces proprietary telecom switches with a software implementation running on commodity hardware. CVE-2026-49472 affects FreeSWITCH versions prior to 1.11.0. The vulnerability resides in the PREFIX(prologTok)() function inside libs/xmlrpc-c/lib/expat/xmltok/xmltok_impl.c. This code was cloned from an outdated version of libexpat/libexpat and never received the upstream security patch. An attacker with low privileges can exploit the flaw over the network to cause a high-impact availability issue against the FreeSWITCH service. The issue is tracked under [CWE-116] and was fixed in version 1.11.0.

Critical Impact
Network-reachable attackers with low privileges can trigger a denial-of-service condition in FreeSWITCH by abusing the unpatched XML parsing routine cloned from a vulnerable libexpat version.

Affected Products

FreeSWITCH versions prior to 1.11.0
Deployments using the bundled libs/xmlrpc-c/lib/expat/xmltok/xmltok_impl.c parser
SignalWire FreeSWITCH distributions built from affected source trees

Discovery Timeline

2026-06-09 - CVE-2026-49472 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-49472

Vulnerability Analysis

The vulnerability stems from a stale code clone of the Expat XML parser inside the FreeSWITCH source tree. FreeSWITCH bundles a vendored copy of xmlrpc-c, which itself includes a copy of libexpat. When the upstream libexpat project patched a security issue in its prologTok tokenizer routine, the cloned copy inside FreeSWITCH was not synchronized. As a result, the PREFIX(prologTok)() function in libs/xmlrpc-c/lib/expat/xmltok/xmltok_impl.c retained the vulnerable parsing logic. The classification falls under [CWE-116] (Improper Encoding or Escaping of Output), reflecting the parser's mishandling of XML prolog tokens. Successful exploitation produces a high-impact effect on availability without affecting confidentiality or integrity.

Root Cause

The root cause is software supply chain drift. FreeSWITCH maintained a vendored copy of libexpat through xmlrpc-c but did not track upstream security fixes. The unpatched prologTok tokenizer remains reachable through FreeSWITCH XML-RPC processing paths. The EPSS score is 0.04% with a percentile of 12.298, indicating low observed exploitation likelihood in the wild as of 2026-06-11.

Attack Vector

An attacker reaches the vulnerable parser over the network and must hold low-level privileges on the FreeSWITCH service interface. The high attack complexity reflects the specific conditions required to trigger the parser fault. A crafted XML document submitted to a FreeSWITCH endpoint that routes input through prologTok causes the parser to fail in a way that disrupts availability of the telecom service. No code example is published with the advisory. See the GitHub Security Advisory GHSA-4jm3-xpcm-mwwq for technical details.

Detection Methods for CVE-2026-49472

Indicators of Compromise

Unexpected crashes or restarts of the freeswitch process correlated with inbound XML-RPC traffic
Malformed XML payloads targeting FreeSWITCH XML-RPC listeners in network captures
Repeated client connections sending oversized or malformed XML prolog content prior to a service failure

Detection Strategies

Inspect FreeSWITCH binaries to confirm the build version; any version below 1.11.0 is affected
Monitor process supervision logs (systemd, init, container orchestrator) for repeated FreeSWITCH restarts
Apply network intrusion detection rules that flag malformed XML prologs sent to FreeSWITCH XML-RPC ports

Monitoring Recommendations

Centralize FreeSWITCH service logs and alert on abnormal termination events
Track XML-RPC request rates and payload sizes against historical baselines
Correlate availability events on telephony services with upstream network sources to identify abusive clients

How to Mitigate CVE-2026-49472

Immediate Actions Required

Upgrade FreeSWITCH to version 1.11.0 or later, where the cloned prologTok code has been patched
Restrict network access to FreeSWITCH XML-RPC interfaces to trusted management networks only
Enforce authentication on management endpoints and rotate credentials used by low-privilege accounts

Patch Information

The fix is included in FreeSWITCH v1.11.0. Refer to the FreeSWITCH v1.11.0 release notes and the GitHub Security Advisory GHSA-4jm3-xpcm-mwwq for the full advisory and patch references.

Workarounds

Block external access to the FreeSWITCH XML-RPC port at the firewall until the upgrade is applied
Place FreeSWITCH behind a reverse proxy that validates XML payload structure before forwarding requests
Disable the XML-RPC module in freeswitch.xml configuration if it is not required for your deployment

bash

# Configuration example: restrict XML-RPC listener to localhost in conf/autoload_configs/xml_rpc.conf.xml
# <param name="http-port" value="8080"/>
# <param name="http-address" value="127.0.0.1"/>
# Then enforce upstream firewall rules:
iptables -A INPUT -p tcp --dport 8080 ! -s 10.0.0.0/24 -j DROP