CVE-2026-116570

Name of the Vulnerable Software and Affected Versions FreeSWITCH versions prior to 1.11.2

Description The http directory auth() function rebuilds an expected user@domain:password credential and base64-encodes it into an 80-byte buffer using an encoder that lacks an output-length argument. If a configured credential exceeds 57 characters, it causes a stack overflow before the HTTP Basic password is compared. An unauthenticated client can trigger this by naming an existing directory user on an exposed mod xml rpc HTTP listener. This overflow can corrupt the stack and crash the software, resulting in the termination of all active calls.

Recommendations Update to version 1.11.2. As a temporary mitigation, avoid loading the mod xml rpc module if it is not required.