Product by Signalwire
Freeswitch
39 known vulnerabilities in Freeswitch (Signalwire), 0 of them actively exploited (CISA KEV).
Key figures
39
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
5
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2026-116779 | FreeSWITCH: Inbound SIP MESSAGE can select the api chat proto and run FreeSWITCH API commands | 9.8 | |
| Critical | CVE-2026-116785 | Signalwire Freeswitch: Heap-based Buffer Overflow | 9.1 | |
| High | CVE-2021-37624 | FreeSWITCH does not authenticate SIP MESSAGE requests, leading to spam and message spoofing | 7.5 | |
| High | CVE-2021-41105 | FreeSWITCH susceptible to Denial of Service via invalid SRTP packets | 7.5 | |
| High | CVE-2026-116783 | FreeSWITCH mod_spandsp: out-of-bounds write parsing UDPTL error-recovery data | 8.2 | |
| High | CVE-2026-115928 | FreeSWITCH: Stack buffer overflow parsing the SDP a=crypto key material on inbound calls | 7.5 | |
| High | CVE-2021-41145 | FreeSWITCH susceptible to Denial of Service via SIP flooding | 8.6 | |
| High | CVE-2021-36513 | Signalwire Freeswitch: Use of Uninitialized Memory | 7.5 | |
| High | CVE-2026-116569 | FreeSWITCH: Pre-authentication out-of-bounds write in MSRP message body parsing | 7.5 | |
| High | CVE-2026-116786 | FreeSWITCH: Channel-variable injection via SIP REFER leads to command execution in mod_sofia | 8.8 | |
| High | CVE-2023-51443 | FreeSWITCH susceptible to Denial of Service via DTLS Hello packets during call initiation | 7.5 | |
| High | CVE-2026-116570 | FreeSWITCH: Pre-authentication stack buffer overflow in mod_xml_rpc HTTP directory authentication | 7.5 | |
| High | CVE-2026-116782 | FreeSWITCH: Pre-authentication invalid pointer dereference in mod_rtmp connect command handling | 7.5 | |
| High | CVE-2026-116568 | FreeSWITCH: Out-of-bounds read in mod_rtmp H.264 video message parsing | 7.5 | |
| Critical | CVE-2026-116790 | FreeSWITCH: Inbound ICE connectivity checks are accepted without verifying STUN MESSAGE-INTEGRITY | 9.1 | |
| High | CVE-2026-116787 | Signalwire Freeswitch: Memory Allocation with Excessive Size Value | 7.5 | |
| High | CVE-2026-116788 | FreeSWITCH: Pre-authentication heap buffer overflow in core XML empty-entity decoding | 8.2 | |
| High | CVE-2026-116784 | FreeSWITCH: Out-of-bounds read in RTCP NACK feedback parsing | 7.5 | |
| High | CVE-2026-116567 | FreeSWITCH: Pre-authentication stack buffer overflow in mod_rtmp control-message handling | 7.5 | |
| Critical | CVE-2026-49841 | FreeSWITCH: Pre-authentication heap buffer overflow in `mod_verto` HTTP POST body read | 9.8 | |
| Medium | CVE-2026-116572 | FreeSWITCH mod_sofia: stack buffer overflow from an over-long SIP Contact display-name | 6.5 | |
| Medium | CVE-2026-116573 | FreeSWITCH mod_sofia: stack buffer overflow from an over-long SIP To-header user | 6.5 | |
| Medium | CVE-2021-41157 | FreeSWITCH does not authenticate SIP SUBSCRIBE requests by default | 5.3 | |
| High | CVE-2023-40018 | Signalwire Freeswitch: Out-of-bounds Write | 7.5 | |
| High | CVE-2023-40019 | Signalwire Freeswitch: Allocation of Resources Without Limits or Throttling | 7.5 |
News
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 24sans-atrisk-mail,