CVE-2026-45771: Freeswitch Denial-of-Service in SIP PUBLISH Requests via XML Entity Expansion

Synopsis

This is an XML Entity Expansion (also known as a billion-laughs) denial-of-service vulnerability in FreeSWITCH, the open-source software-defined telecom stack. A remote, unauthenticated attacker can send a single crafted SIP PUBLISH request containing a malicious DTD payload that causes the XML parser to expand nested entity declarations without bound, consuming all available CPU and memory. Successful exploitation crashes or hangs the FreeSWITCH process, taking the affected telephony service offline. No fix version has been published yet; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the FreeSWITCH SIP listener over the network; no prior foothold on the host is needed.

• AuthenticationNot required

  The vulnerable XML parser processes the PIDF body of a SIP PUBLISH before any digest authentication check, so no credentials are required.

• Victim interactionNot required

  The attacker sends a single crafted request with no need for any user or administrator to interact with it.

• Attack complexityDetail

  Exploitation is reliable and condition-free; crafting a valid billion-laughs DTD payload requires no special timing, memory layout knowledge, or environmental dependencies.

Blast Radius

• The FreeSWITCH process consumes all available CPU cycles attempting to expand the recursive entity tree, rendering call processing unresponsive.
• Unbounded memory allocation causes the host to exhaust RAM and potentially swap, which can destabilize other co-located services or containers on the same node.
• All active SIP sessions handled by the affected FreeSWITCH instance are dropped, interrupting in-progress voice and video calls.
• The service remains unavailable until the process is killed and restarted, giving the attacker a persistent denial-of-service window with repeated single-packet requests.