CVE-2026-49842

Name of the Vulnerable Software and Affected Versions FreeSWITCH versions prior to 1.11.1

Description In the mod verto module, the WebSocket frame loop intercepts speed-test protocols prefixed with # (#SPU, #SPB, and #SPE) before performing authentication checks. The payload size in #SPU is parsed using the atoi() function, which only rejects non-positive values. This allows an unauthenticated peer to request up to INT MAX bytes. During the download phase, the server responds with approximately 10 times the requested size, potentially sending around 20 GB per request, which results in significant outbound bandwidth amplification.

Recommendations Update to version 1.11.1.