CVE-2026-116786

FreeSWITCH versions prior to 1.11.2 are vulnerable to command execution due to a channel-variable injection flaw in the mod_sofia module. The vulnerability exists because sofia_handle_sip_i_refer() inserts raw Refer-To URI parameters and headers into a sip_invite_params channel-variable block. Be...

CVE-2026-116572

The FreeSWITCH telecommunications platform (versions 1.10.0 to 1.11.1 ) contains a stack-based buffer overflow in the mod_sofia component. The root cause is the insufficient handling of SIP Contact display names during dialog-event notifications. An attacker can provide an excessively long displa...

CVE-2026-116573

The open-source telecommunications platform FreeSWITCH versions 1.10.0 through 1.11.1 is vulnerable to a stack-based buffer overflow in the mod_sofia component. The flaw occurs when generating dialog-event notifications; a peer can provide an excessively long SIP To-header user part and subscribe...