CVE-2026-49847: FreeSWITCH: Stack overflow in bundled cJSON parser via deeply nested JSON

Synopsis

Stack-based buffer overflow (stack exhaustion via recursive JSON parsing) in FreeSWITCH's bundled cJSON parser allows a remote, unauthenticated attacker to crash the FreeSWITCH process by sending a single WebSocket frame containing a deeply nested JSON document. The recursion drives the worker thread's stack pointer into the kernel stack guard page, raising SIGSEGV and terminating all active calls and sessions on the host. No authentication or victim interaction is required; the service only needs to be reachable over the network. A patched-image rebuild at version 1.11.1 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the FreeSWITCH WebSocket endpoint over the network; no local or physical access is needed, but the service port must be exposed to the attacker.

• AuthenticationNot required

  No account or credential is needed; a single unauthenticated WebSocket frame is sufficient to trigger the crash.

• Victim interactionNot required

  The attacker sends the malicious frame directly to the server; no user action or social engineering is involved.

• Attack complexityDetail

  Exploitation is reliable and condition-free: crafting a deeply nested JSON document requires no timing, memory-layout knowledge, or special environmental state.

Blast Radius

• Crashes the FreeSWITCH process immediately, dropping every active call and session on the host.
• Raises an unhandled SIGSEGV that terminates the worker thread and the parent process, causing a full service outage until the process is restarted.
• No confidential data is read and no persistent state is modified; impact is limited to availability.