CVE-2026-49840

Name of the Vulnerable Software and Affected Versions FreeSWITCH versions prior to 1.11.1

Description The esl recv event() function parses the Content-Length header using atol() and passes the result to malloc(len + 1) without verifying the sign or magnitude of the value. A malicious or man-in-the-middle Event Socket Layer (ESL) peer can send a frame containing a negative Content-Length to cause heap corruption or crash any process linked against libesl. This can occur before the client has authenticated to the peer.

Recommendations Update to version 1.11.1.