AI analysis
Claude Opus · 8 Nov 2026, 10:21 CET
FreeSWITCH WebSocket flaw lets unauthenticated clients crash the telecom stack
A heap overflow in FreeSWITCH versions before 1.11.2 lets an unauthenticated client who completes a WebSocket upgrade on an enabled mod_xml_rpc endpoint overwrite memory and crash the server, ending all active sessions. Upgrade to 1.11.2.
In plain terms
FreeSWITCH is open-source software that runs telephone and voice services on standard servers. A flaw in how it processes WebSocket data (a two-way connection used by web and application clients) lets an attacker send a specially sized message that writes past the end of a memory buffer. This can corrupt internal data and crash the whole service, dropping every call or session in progress.
This matters most to organisations running FreeSWITCH with the mod_xml_rpc module and its WebSocket endpoint enabled, because an attacker reaches the vulnerable code before any login check. Both the module and the WebSocket endpoint are disabled by default, so many installations are not exposed, but anyone who has turned them on should act.