signalwire freeswitch vulnerabilities

CVEs per yearBy the year they were published

1. 20215
2. 20233
3. 202630

Newest CVEs

• CVE-2026-116782

  FreeSWITCH: Pre-authentication invalid pointer dereference in mod_rtmp connect command handling

  signalwire · freeswitch

  High7.5
• CVE-2026-116783

  FreeSWITCH mod_spandsp: out-of-bounds write parsing UDPTL error-recovery data

  signalwire · freeswitch

  High8.2
• CVE-2026-116790

  FreeSWITCH: Inbound ICE connectivity checks are accepted without verifying STUN MESSAGE-INTEGRITY

  signalwire · freeswitch

  Critical9.1
• CVE-2026-116788

  FreeSWITCH: Pre-authentication heap buffer overflow in core XML empty-entity decoding

  signalwire · freeswitch

  High8.2
• CVE-2026-116780

  FreeSWITCH: Heap out-of-bounds read in FreeSWITCH core variable expansion via `${variable:offset}` slicing

  signalwire · freeswitch

  Low2.7
• CVE-2026-116784

  FreeSWITCH: Out-of-bounds read in RTCP NACK feedback parsing

  signalwire · freeswitch

  High7.5
• CVE-2026-116779

  FreeSWITCH: Inbound SIP MESSAGE can select the api chat proto and run FreeSWITCH API commands

  signalwire · freeswitch

  Critical9.8
• CVE-2026-116789

  FreeSWITCH: DTLS-SRTP peer certificate is not bound to the SDP fingerprint when FreeSWITCH is the DTLS server

  signalwire · freeswitch

  High7.4
• CVE-2026-116781

  FreeSWITCH: Pre-authentication out-of-bounds writes in mod_xml_rpc WebSocket frame parsing

  signalwire · freeswitch

  Medium5.3
• CVE-2026-116785

  FreeSWITCH: Pre-authentication heap out-of-bounds write in mod_xml_rpc WebSocket frame length handling

  signalwire · freeswitch

  Critical9.1