CVE-2026-49847: FreeSWITCH Buffer Overflow Vulnerability

CVE-2026-49847 Overview

CVE-2026-49847 is a denial-of-service vulnerability in FreeSWITCH, the open-source software-defined telecom stack maintained by SignalWire. A single unauthenticated WebSocket frame containing a deeply nested JSON document crashes the FreeSWITCH process through a stack overflow. The crash terminates all active calls and sessions on the affected host. The flaw is tracked under [CWE-674] (Uncontrolled Recursion) and affects all versions prior to 1.11.1.

Critical Impact
An unauthenticated remote attacker can crash any internet-reachable FreeSWITCH instance with one crafted WebSocket frame, dropping every call and session on the host.

Affected Products

FreeSWITCH versions prior to 1.11.1
Deployments exposing the WebSocket interface to untrusted networks
Telecom and unified communications stacks built on FreeSWITCH

Discovery Timeline

2026-06-09 - CVE-2026-49847 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-49847

Vulnerability Analysis

FreeSWITCH exposes a WebSocket endpoint that accepts JSON-formatted control messages. The JSON parser processes nested objects and arrays using recursive descent. Each level of nesting consumes a stack frame on the worker thread handling the connection.

When an attacker submits a JSON document with sufficient recursive depth, the worker thread's stack pointer advances into the stack guard page. The kernel detects the guard page access and raises SIGSEGV, terminating the FreeSWITCH process. Because the fault occurs before any usable memory write primitive develops, the issue is limited to availability impact rather than code execution.

The outage scope is total. A single frame ends every concurrent call, registration, and session on the host. Authentication is not required because the parser executes against the inbound frame before any session validation step.

Root Cause

The root cause is uncontrolled recursion in the WebSocket JSON parsing path. The parser lacks a maximum-depth guard, so attacker-controlled nesting determines stack consumption. Version 1.11.1 introduces input bounds that cap nesting depth before the guard page is reached.

Attack Vector

Exploitation requires network reachability to the FreeSWITCH WebSocket listener. The attacker opens a WebSocket connection and sends one frame containing a JSON payload with thousands of nested objects or arrays, such as repeated {"a": tokens. The recursive parser exhausts the thread stack, the kernel raises SIGSEGV, and the FreeSWITCH process terminates. Refer to the GitHub Security Advisory GHSA-2v74-pcgh-75wg for additional technical detail.

Detection Methods for CVE-2026-49847

Indicators of Compromise

Unexpected SIGSEGV termination of the freeswitch process with crash dumps showing deep recursion in the JSON parser
WebSocket frames from external sources containing JSON payloads with abnormally high nesting depth
Sudden simultaneous drop of all active SIP calls and registrations on a FreeSWITCH host
Repeated short-lived WebSocket connections from a single source IP followed by service restart events

Detection Strategies

Inspect WebSocket traffic at a reverse proxy or WAF for JSON payloads exceeding a reasonable nesting depth, such as 32 levels
Monitor process supervisors (systemd, monit) for repeated FreeSWITCH crash-restart cycles
Correlate kernel segfault log entries referencing the FreeSWITCH binary with inbound WebSocket activity

Monitoring Recommendations

Alert on any SIGSEGV exit code from the FreeSWITCH service in /var/log/messages or journalctl
Track WebSocket connection counts and payload sizes per source IP to identify probing
Forward FreeSWITCH and kernel logs to a centralized SIEM for correlation with network telemetry

How to Mitigate CVE-2026-49847

Immediate Actions Required

Upgrade FreeSWITCH to version 1.11.1 or later using the GitHub Release v1.11.1
Restrict the WebSocket listener to trusted networks via firewall rules until the upgrade is applied
Place a reverse proxy in front of FreeSWITCH that enforces a maximum JSON depth and frame size

Patch Information

SignalWire fixed the issue in FreeSWITCH 1.11.1. The patched release adds a depth limit to the JSON parser so that recursive input is rejected before the thread stack is exhausted. Details are available in the GitHub Security Advisory GHSA-2v74-pcgh-75wg.

Workarounds

Disable the WebSocket interface in modules.conf.xml if it is not required for operations
Terminate WebSocket connections at an upstream proxy such as NGINX or HAProxy with strict body-size and parsing limits
Apply ACLs in acl.conf.xml to permit WebSocket sources only from authenticated peer networks
Configure process supervision to restart FreeSWITCH automatically while exposure is reduced through network controls

bash

# Configuration example: restrict WebSocket access with iptables until patched
iptables -A INPUT -p tcp --dport 7443 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 7443 -j DROP

# Verify FreeSWITCH version after upgrade
fs_cli -x 'version'