CVE-2026-116781

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, wsreadframe unmasked a WebSocket payload by iterating wsh-datalen, which included frame headers,...

CVE-2026-116785

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, wsreadframe decoded a WebSocket frame's 64-bit extended payload length with a 32-bit byte swap an...

CVE-2026-116781

Prior to version 1.11.2 , FreeSWITCH is vulnerable to pre-authentication out-of-bounds writes within the mod_xml_rpc module during WebSocket frame parsing. The flaw exists in the ws_read_frame() function, which incorrectly iterates over wsh->datalen (including frame headers) while indexing fro...

CVE-2026-116781 FreeSWITCH: Pre-authentication out-of-bounds writes in mod_xml_rpc WebSocket frame parsing

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, wsreadframe unmasked a WebSocket payload by iterating wsh-datalen, which included frame headers,...

CVE-2026-116785 FreeSWITCH: Pre-authentication heap out-of-bounds write in mod_xml_rpc WebSocket frame length handling

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, wsreadframe decoded a WebSocket frame's 64-bit extended payload length with a 32-bit byte swap an...

CVE-2026-116785

Prior to version 1.11.2 , FreeSWITCH is vulnerable to a pre-authentication heap out-of-bounds write within the mod_xml_rpc module. The root cause is located in the ws_read_frame() function, which incorrectly decodes a WebSocket frame's 64-bit extended payload length. By narrowing the result into ...

CVE-2026-107909

A heap-based out-of-bounds write in the wsreadframe function src/bolt/ws.c and the bufferapplymask function src/bolt/buffer.c in FalkorDB before 4.20.0 allows a remote unauthenticated attacker to cause a denial of service and possibly corrupt heap memory by sending a WebSocket frame with a 64-bit...

CVE-2026-107909

A heap-based out-of-bounds write in the wsreadframe function src/bolt/ws.c and the bufferapplymask function src/bolt/buffer.c in FalkorDB before 4.20.0 allows a remote unauthenticated attacker to cause a denial of service and possibly corrupt heap memory by sending a WebSocket frame with a 64-bit...

CVE-2026-107909

FalkorDB versions before 4.20.0 are vulnerable to a pre-authentication heap out-of-bounds write in the ws_read_frame and buffer_apply_mask functions. This occurs because WebSocket frames with a 64-bit extended payload length are not properly bounded; the existing check is an ASSERT() that is omit...

CVE-2026-107909 Pre-authentication heap out-of-bounds write in FalkorDB Bolt WebSocket frame handling via unbounded payload length

A heap-based out-of-bounds write in the wsreadframe function src/bolt/ws.c and the bufferapplymask function src/bolt/buffer.c in FalkorDB before 4.20.0 allows a remote unauthenticated attacker to cause a denial of service and possibly corrupt heap memory by sending a WebSocket frame with a 64-bit...

CVE-2026-107909 Pre-authentication heap out-of-bounds write in FalkorDB Bolt WebSocket frame handling via unbounded payload length

A heap-based out-of-bounds write in the wsreadframe function src/bolt/ws.c and the bufferapplymask function src/bolt/buffer.c in FalkorDB before 4.20.0 allows a remote unauthenticated attacker to cause a denial of service and possibly corrupt heap memory by sending a WebSocket frame with a 64-bit...

CVE-2026-107909: Out-of-bounds Write

A heap-based out-of-bounds write in the wsreadframe function src/bolt/ws.c and the bufferapplymask function src/bolt/buffer.c in FalkorDB before 4.20.0 allows a remote unauthenticated attacker to cause a denial of service and possibly corrupt heap memory by sending a WebSocket frame with a 64-bit...