# signalwire freeswitch.

Every CVE that names signalwire freeswitch among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [FreeSWITCH: Pre-authentication invalid pointer dereference in mod_rtmp connect command handling](https://agentprime.io/advisories/CVE-2026-116782.md)
  `CVE-2026-116782` · CVE record: signalwire freeswitch · CVSS 7.5 High · Not analysed yet · Published 5 Nov 2026 · Tags: Memory corruption
- [FreeSWITCH mod_spandsp: out-of-bounds write parsing UDPTL error-recovery data](https://agentprime.io/advisories/CVE-2026-116783.md)
  `CVE-2026-116783` · CVE record: signalwire freeswitch · CVSS 8.2 High · Not analysed yet · Published 5 Nov 2026 · Tags: Memory corruption, CWE-129
- [FreeSWITCH: Inbound ICE connectivity checks are accepted without verifying STUN MESSAGE-INTEGRITY](https://agentprime.io/advisories/CVE-2026-116790.md)
  `CVE-2026-116790` · CVE record: signalwire freeswitch · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Nov 2026 · Tags: Authentication bypass, Weak cryptography or TLS
- [FreeSWITCH: Pre-authentication heap buffer overflow in core XML empty-entity decoding](https://agentprime.io/advisories/CVE-2026-116788.md)
  `CVE-2026-116788` · CVE record: signalwire freeswitch · CVSS 8.2 High · Not analysed yet · Published 5 Nov 2026 · Tags: Memory corruption
- [FreeSWITCH: Heap out-of-bounds read in FreeSWITCH core variable expansion via \`${variable:offset}\` slicing](https://agentprime.io/advisories/CVE-2026-116780.md)
  `CVE-2026-116780` · CVE record: signalwire freeswitch · CVSS 2.7 Low · Not analysed yet · Published 5 Nov 2026 · Tags: Memory corruption, Information disclosure
- [FreeSWITCH: Out-of-bounds read in RTCP NACK feedback parsing](https://agentprime.io/advisories/CVE-2026-116784.md)
  `CVE-2026-116784` · CVE record: signalwire freeswitch · CVSS 7.5 High · Not analysed yet · Published 5 Nov 2026 · Tags: Memory corruption
- [FreeSWITCH: Inbound SIP MESSAGE can select the api chat proto and run FreeSWITCH API commands](https://agentprime.io/advisories/CVE-2026-116779.md)
  `CVE-2026-116779` · CVE record: signalwire freeswitch · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Nov 2026 · Tags: Command injection, CWE-749
- [FreeSWITCH: DTLS-SRTP peer certificate is not bound to the SDP fingerprint when FreeSWITCH is the DTLS server](https://agentprime.io/advisories/CVE-2026-116789.md)
  `CVE-2026-116789` · CVE record: signalwire freeswitch · CVSS 7.4 High · Not analysed yet · Published 5 Nov 2026 · Tags: Weak cryptography or TLS, CWE-300
- [FreeSWITCH: Pre-authentication out-of-bounds writes in mod_xml_rpc WebSocket frame parsing](https://agentprime.io/advisories/CVE-2026-116781.md)
  `CVE-2026-116781` · CVE record: signalwire freeswitch · CVSS 5.3 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Memory corruption, CWE-193
- [FreeSWITCH: Pre-authentication heap out-of-bounds write in mod_xml_rpc WebSocket frame length handling](https://agentprime.io/advisories/CVE-2026-116785.md)
  `CVE-2026-116785` · CVE record: signalwire freeswitch · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Nov 2026 · Tags: Memory corruption, CWE-681
- [FreeSWITCH: Channel-variable injection via SIP REFER leads to command execution in mod_sofia](https://agentprime.io/advisories/CVE-2026-116786.md)
  `CVE-2026-116786` · CVE record: signalwire freeswitch · CVSS 8.8 High · Not analysed yet · Published 5 Nov 2026 · Tags: Command injection, Code injection
- [FreeSWITCH: Pre-authentication process termination in the Event Socket via an unbounded Content-Length](https://agentprime.io/advisories/CVE-2026-116787.md)
  `CVE-2026-116787` · CVE record: signalwire freeswitch · CVSS 7.5 High · Not analysed yet · Published 5 Nov 2026 · Tags: Memory corruption, Denial of service
- [FreeSWITCH: Pre-authentication stack buffer overflow in mod_rtmp control-message handling](https://agentprime.io/advisories/CVE-2026-116567.md)
  `CVE-2026-116567` · CVE record: signalwire freeswitch · CVSS 7.5 High · Not analysed yet · Published 5 Nov 2026 · Tags: Memory corruption
- [FreeSWITCH: Stack buffer overflow in mod_rtmp AVC sequence-header construction](https://agentprime.io/advisories/CVE-2026-116571.md)
  `CVE-2026-116571` · CVE record: signalwire freeswitch · CVSS 5.9 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Memory corruption
- [FreeSWITCH: Pre-authentication stack buffer overflow in mod_xml_rpc HTTP directory authentication](https://agentprime.io/advisories/CVE-2026-116570.md)
  `CVE-2026-116570` · CVE record: signalwire freeswitch · CVSS 7.5 High · Not analysed yet · Published 5 Nov 2026 · Tags: Memory corruption
- [FreeSWITCH: Pre-authentication out-of-bounds write in MSRP message body parsing](https://agentprime.io/advisories/CVE-2026-116569.md)
  `CVE-2026-116569` · CVE record: signalwire freeswitch · CVSS 7.5 High · Not analysed yet · Published 5 Nov 2026 · Tags: Memory corruption
- [FreeSWITCH: Out-of-bounds read in mod_rtmp H.264 video message parsing](https://agentprime.io/advisories/CVE-2026-116568.md)
  `CVE-2026-116568` · CVE record: signalwire freeswitch · CVSS 7.5 High · Not analysed yet · Published 5 Nov 2026 · Tags: Memory corruption
- [FreeSWITCH mod_sofia: stack buffer overflow from an over-long SIP Contact display-name](https://agentprime.io/advisories/CVE-2026-116572.md)
  `CVE-2026-116572` · CVE record: signalwire freeswitch · CVSS 6.5 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Memory corruption
- [FreeSWITCH: Stack buffer overflow parsing the SDP a=crypto key material on inbound calls](https://agentprime.io/advisories/CVE-2026-115928.md)
  `CVE-2026-115928` · CVE record: signalwire freeswitch · CVSS 7.5 High · Not analysed yet · Published 5 Nov 2026 · Tags: Memory corruption
- [FreeSWITCH: Off-by-one heap write in core XML serialization of four-byte UTF-8 sequences](https://agentprime.io/advisories/CVE-2026-116574.md)
  `CVE-2026-116574` · CVE record: signalwire freeswitch · CVSS 5.9 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Memory corruption, CWE-193
- [FreeSWITCH mod_sofia: stack buffer overflow from an over-long SIP To-header user](https://agentprime.io/advisories/CVE-2026-116573.md)
  `CVE-2026-116573` · CVE record: signalwire freeswitch · CVSS 6.5 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Memory corruption
- [FreeSWITCH: Pre-authentication \`userVariables\` injection in \`mod_verto\`](https://agentprime.io/advisories/CVE-2026-49848.md)
  `CVE-2026-49848` · CVE record: signalwire freeswitch · CVSS 4.3 Medium · Not analysed yet · Published 9 Jun 2026 · Tags: Authentication bypass
- [FreeSWITCH: Stack overflow in bundled cJSON parser via deeply nested JSON](https://agentprime.io/advisories/CVE-2026-49847.md)
  `CVE-2026-49847` · CVE record: signalwire freeswitch · CVSS 7.5 High · Not analysed yet · Published 9 Jun 2026 · Tags: Denial of service
- [FreeSWITCH: Pre-authentication session eviction via attacker-chosen \`sessid\` in \`mod_verto\`](https://agentprime.io/advisories/CVE-2026-49843.md)
  `CVE-2026-49843` · CVE record: signalwire freeswitch · CVSS 5.3 Medium · Not analysed yet · Published 9 Jun 2026 · Tags: Authentication bypass
- [FreeSWITCH: Pre-authentication bandwidth amplification via \`mod_verto\` speed-test frames](https://agentprime.io/advisories/CVE-2026-49842.md)
  `CVE-2026-49842` · CVE record: signalwire freeswitch · CVSS 7.5 High · Not analysed yet · Published 9 Jun 2026 · Tags: Denial of service
- [FreeSWITCH: Pre-authentication heap buffer overflow in \`mod_verto\` HTTP POST body read](https://agentprime.io/advisories/CVE-2026-49841.md)
  `CVE-2026-49841` · CVE record: signalwire freeswitch · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Jun 2026 · Tags: Memory corruption
- [FreeSWITCH: Pre-authentication heap buffer overflow in libesl \`Content-Length\` parsing](https://agentprime.io/advisories/CVE-2026-49840.md)
  `CVE-2026-49840` · CVE record: signalwire freeswitch · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Jun 2026 · Tags: Memory corruption, CWE-20, CWE-195
- [FreeSWITCH: Out-of-bounds memory access in core STUN attribute parsing](https://agentprime.io/advisories/CVE-2026-49475.md)
  `CVE-2026-49475` · CVE record: signalwire freeswitch · CVSS 7.5 High · Not analysed yet · Published 9 Jun 2026 · Tags: Memory corruption, CWE-20
- [FreeSWITCH includes a vulnerable function, PREFIX(prologTok)() from libexpat](https://agentprime.io/advisories/CVE-2026-49472.md)
  `CVE-2026-49472` · CVE record: signalwire freeswitch · CVSS 5.3 Medium · Not analysed yet · Published 9 Jun 2026 · Tags: CWE-116
- [Freeswitch Denial-of-Service in SIP PUBLISH Requests via XML Entity Expansion](https://agentprime.io/advisories/CVE-2026-45771.md)
  `CVE-2026-45771` · CVE record: signalwire freeswitch · CVSS 7.5 High · Not analysed yet · Published 9 Jun 2026 · Tags: Denial of service
- [FreeSWITCH susceptible to Denial of Service via DTLS Hello packets during call initiation](https://agentprime.io/advisories/CVE-2023-51443.md)
  `CVE-2023-51443` · CVE record: signalwire freeswitch · CVSS 7.5 High · Not analysed yet · Published 27 Dec 2023 · Tags: CWE-703
- [FreeSWITCH allows authorized users to cause a denial of service attack by sending re-INVITE with SDP containing duplicate codec names](https://agentprime.io/advisories/CVE-2023-40019.md)
  `CVE-2023-40019` · CVE record: signalwire freeswitch · CVSS 7.5 High · Not analysed yet · Published 15 Sept 2023 · Tags: Denial of service
- [FreeSWITCH allows remote users to trigger out of bounds write by offering an ICE candidate with unknown component ID](https://agentprime.io/advisories/CVE-2023-40018.md)
  `CVE-2023-40018` · CVE record: signalwire freeswitch · CVSS 7.5 High · Not analysed yet · Published 15 Sept 2023 · Tags: Memory corruption
- [FreeSWITCH vulnerable to SIP digest leak for configured gateways](https://agentprime.io/advisories/CVE-2021-41158.md)
  `CVE-2021-41158` · CVE record: signalwire freeswitch · CVSS 5.8 Medium · Not analysed yet · Published 26 Oct 2021 · Tags: Information disclosure
- [FreeSWITCH does not authenticate SIP SUBSCRIBE requests by default](https://agentprime.io/advisories/CVE-2021-41157.md)
  `CVE-2021-41157` · CVE record: signalwire freeswitch · CVSS 5.3 Medium · Not analysed yet · Published 26 Oct 2021 · Tags: Authentication bypass
- [FreeSWITCH susceptible to Denial of Service via invalid SRTP packets](https://agentprime.io/advisories/CVE-2021-41105.md)
  `CVE-2021-41105` · CVE record: signalwire freeswitch · CVSS 7.5 High · Not analysed yet · Published 25 Oct 2021 · Tags: CWE-20
- [FreeSWITCH susceptible to Denial of Service via SIP flooding](https://agentprime.io/advisories/CVE-2021-41145.md)
  `CVE-2021-41145` · CVE record: signalwire freeswitch · CVSS 8.6 High · Not analysed yet · Published 25 Oct 2021 · Tags: Denial of service
- [FreeSWITCH does not authenticate SIP MESSAGE requests, leading to spam and message spoofing](https://agentprime.io/advisories/CVE-2021-37624.md)
  `CVE-2021-37624` · CVE record: signalwire freeswitch · CVSS 7.5 High · Not analysed yet · Published 25 Oct 2021 · Tags: Authentication bypass

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=signalwire-freeswitch>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/signalwire-freeswitch/>. Everything for agents: <https://agentprime.io/llms.txt>.