Tags › CVE-2026-119293

FreeSWITCH: RTP Bleed, RTP Inject and DoS

We reported two FreeSWITCH media security issues as one finding before ClueCon 2025. They now have separate CVEs: one for RTP Bleed and Inject during call setup, another for one-way media denial on established calls. FreeSWITCH 1.11.2 addresses the latter, but mitigating the former also requires configuration.…

FreeSWITCH: RTP Bleed and RTP Inject through unvalidated source learning

• Authors:
  • Enable Security research team
• CVSS v4.0:
  • Base score: 9.3 Critical
  • Exploitability: High
  • Complexity: Low
  • Attack requirements: None
  • Vulnerable system: High availability impact
  • Subsequent system: High confidentiality and integrity impact
  • Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:H/SI:H/SA:N
• CVE: CVE-2026-119293
• Fixed versions: No default-configured release was verified to close this issue. FreeSWITCH 1.11.2 adds two opt-in channel variables that mitigated persistent takeover in our tests when configured before RTP session creation; verify the effective settings on later releases.
• Enable Security Advisory: https://www.enablesecurity.com/advisories/ES2026-07-freeswitch-rtp-inject-rtp-bleed/
• Vendor Security Advisory: https://github.com/signalwire/freeswitch/security/advisories/GHSA-cw2f-3w8g-4x9q
• Vendor Patch: https://github.com/signalwire/freeswitch/commit/a38cd8073314f7da29b16743b8dbe52fd8505ba7
• Reproduction tools and Docker Compose before/after lab: https://github.com/EnableSecurity/advisories/tree/master/ES2026-07-freeswitch-rtp-inject-rtp-bleed
• Companion advisory: https://www.enablesecurity.com/advisories/ES2026-08-freeswitch-rtp-media-dos/
• Other references:
  • CWE-346: Origin Validation Error
  • CWE-940: Improper Verification of Source of a Communication Channel
  • FreeSWITCH 1.11.2 release
• Tested vulnerable versions: FreeSWITCH 1.10.12 and FreeSWITCH 1.11.2 with default settings
• Tested mitigated version: FreeSWITCH 1.11.2 with both new channel variables configured
• Affected versions:
  • FreeSWITCH 1.0.0 through 1.11.1 are affected in their default configuration.
  • FreeSWITCH 1.11.2 remains affected unless the new controls are configured before RTP session creation.
• Timeline:
  • First discovery and report to FreeSWITCH developers: 2025-06
  • Upstream hardening commit: 2026-08-08
  • FreeSWITCH 1.11.2 released: 2026-08-09
  • Enable Security verified vulnerable and mitigated behaviour: 2026-08-11
  • Enable Security completed additional advisory reproduction and stock-configuration validation: 2026-10-28
  • Enable Security submitted the two split GitHub advisories: 2026-10-29
  • Vendor advisory published with CVE listed: 2026-11-03

TL;DR

Upgrading to FreeSWITCH 1.11.2 alone does not close this issue. Configure both new RTP source-learning controls before RTP session creation; both default to zero.