CVE-2026-49840: FreeSWITCH: Pre-authentication heap buffer overflow in libesl `Content-Length` parsing

Synopsis

A pre-authentication heap buffer overflow exists in FreeSWITCH's libesl library, specifically in the esl_recv_event() function. The function parses Content-Length headers using atol() without validating sign or magnitude, then passes the result directly to malloc(), allowing a malicious or man-in-the-middle ESL peer to send a negative Content-Length value and corrupt the heap before any authentication takes place. Successful exploitation enables an attacker to tamper with heap memory or crash any process linked against libesl, with no credentials required. A patched-image rebuild at version 1.11.1 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the ESL service over the network to send a crafted Content-Length frame.

• AuthenticationNot required

  No credentials are needed; the malformed frame can be sent before the client authenticates to the ESL peer.

• Victim interactionNot required

  No user action is required; the vulnerable code path is triggered automatically on receipt of the malicious frame.

• Attack complexityDetail

  Exploit conditions are reliable and free of environmental prerequisites; the attacker only needs to send a single crafted frame with a negative Content-Length value.

Blast Radius

• An attacker corrupts heap memory in any process linked against libesl, which can be leveraged to manipulate internal data structures or gain control of execution flow.
• An attacker crashes the targeted FreeSWITCH process or any linked client application, taking telephony or signaling services offline.
• Heap corruption may enable an attacker to overwrite adjacent allocations, altering call routing logic, session state, or configuration data held in memory.