CVE-2026-49847

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-49847", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-01T22:03:19.640Z", "datePublished": "2026-06-09T16:05:08.869Z", "dateUpdated": "2026-06-09T20:20:37.647Z"}, "containers": {"cna": {"title": "FreeSWITCH: Stack overflow in bundled cJSON parser via deeply nested JSON", "problemTypes": [{"descriptions": [{"cweId": "CWE-674", "lang": "en", "description": "CWE-674: Uncontrolled Recursion", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/signalwire/freeswitch/security/advisories/GHSA-2v74-pcgh-75wg", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/signalwire/freeswitch/security/advisories/GHSA-2v74-pcgh-75wg"}, {"name": "https://github.com/signalwire/freeswitch/releases/tag/v1.11.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/signalwire/freeswitch/releases/tag/v1.11.1"}], "affected": [{"vendor": "signalwire", "product": "freeswitch", "versions": [{"version": "< 1.11.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-09T16:05:08.869Z"}, "descriptions": [{"lang": "en", "value": "FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.11.1, a single unauthenticated WebSocket frame containing a deeply nested JSON document crashes the FreeSWITCH process via stack overflow, terminating all calls and sessions on the host. The recursion drives the worker thread's stack pointer into the stack guard page, raising SIGSEGV from the kernel before any usable write primitive develops. This issue has been patched in version 1.11.1."}], "source": {"advisory": "GHSA-2v74-pcgh-75wg", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-09T20:20:23.647601Z", "id": "CVE-2026-49847", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-09T20:20:37.647Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-49847", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-09T20:20:23.647601Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-09T20:20:34.122Z"}}], "cna": {"title": "FreeSWITCH: Stack overflow in bundled cJSON parser via deeply nested JSON", "source": {"advisory": "GHSA-2v74-pcgh-75wg", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "signalwire", "product": "freeswitch", "versions": [{"status": "affected", "version": "< 1.11.1"}]}], "references": [{"url": "https://github.com/signalwire/freeswitch/security/advisories/GHSA-2v74-pcgh-75wg", "name": "https://github.com/signalwire/freeswitch/security/advisories/GHSA-2v74-pcgh-75wg", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/signalwire/freeswitch/releases/tag/v1.11.1", "name": "https://github.com/signalwire/freeswitch/releases/tag/v1.11.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.11.1, a single unauthenticated WebSocket frame containing a deeply nested JSON document crashes the FreeSWITCH process via stack overflow, terminating all calls and sessions on the host. The recursion drives the worker thread's stack pointer into the stack guard page, raising SIGSEGV from the kernel before any usable write primitive develops. This issue has been patched in version 1.11.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-674", "description": "CWE-674: Uncontrolled Recursion"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-09T16:05:08.869Z"}}}, "cveMetadata": {"cveId": "CVE-2026-49847", "state": "PUBLISHED", "dateUpdated": "2026-06-09T20:20:37.647Z", "dateReserved": "2026-06-01T22:03:19.640Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-06-09T16:05:08.869Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "freeswitch", "vendor": "signalwire", "versions": [{"status": "affected", "version": "< 1.11.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:freeswitch:freeswitch:*:*:*:*:*:*:*:*", "matchCriteriaId": "E8AED0D0-D5A1-4AA1-9CAE-13830B74CAC5", "versionEndExcluding": "1.11.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.11.1, a single unauthenticated WebSocket frame containing a deeply nested JSON document crashes the FreeSWITCH process via stack overflow, terminating all calls and sessions on the host. The recursion drives the worker thread's stack pointer into the stack guard page, raising SIGSEGV from the kernel before any usable write primitive develops. This issue has been patched in version 1.11.1."}, {"lang": "es", "value": "FreeSWITCH es una Pila de Telecomunicaciones Definida por Software que permite la transformaci\u00f3n digital de conmutadores de telecomunicaciones propietarios a una implementaci\u00f3n de software que se ejecuta en cualquier hardware comercial. Antes de la versi\u00f3n 1.11.1, una sola trama de WebSocket no autenticada que conten\u00eda un documento JSON profundamente anidado bloqueaba el proceso de FreeSWITCH a trav\u00e9s de un desbordamiento de pila, terminando todas las llamadas y sesiones en el host. La recursi\u00f3n lleva el puntero de pila del hilo de trabajo a la p\u00e1gina de protecci\u00f3n de pila, generando SIGSEGV desde el kernel antes de que se desarrolle cualquier primitiva de escritura utilizable. Este problema ha sido parcheado en la versi\u00f3n 1.11.1."}], "id": "CVE-2026-49847", "lastModified": "2026-07-23T08:10:00.137", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-49847", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-09T20:20:23.647601Z", "version": "2.0.3"}}]}, "published": "2026-06-09T17:17:48.320", "references": [{"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/signalwire/freeswitch/releases/tag/v1.11.1"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/signalwire/freeswitch/security/advisories/GHSA-2v74-pcgh-75wg"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-674"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.11.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "freeswitch", "source": "cna", "vendor": "signalwire"}, "product": "freeswitch", "vendor": "signalwire"}], "created": "2026-06-09T17:45:09.847621+00:00", "updated": "2026-06-09T18:15:11.647056+00:00", "vendors": ["signalwire", "signalwire$PRODUCT$freeswitch"]}