« Volver al listado

CVE-2026-45771

Estado: AnalizadaAlta (7.5)—

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.11.0, FreeSWITCH's bundled XML parser expands nested <!ENTITY> declarations without a depth or count bound, so a small DTD can describe a body that expands exponentially ("billion laughs"). The PIDF body of a SIP PUBLISH is fed to this parser before any digest check, letting an unauthenticated network attacker force unbounded CPU and memory consumption with a single request. This issue has been patched in version 1.11.0.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

XML billion laughs sin autenticación previa en SIP PUBLISH (AV:N, PR:N, UI:N): explotación de aplicación expuesta. Consumo exponencial de CPU/memoria = DoS (T1499.004).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Filter Network TrafficVulnerability ScanningPrivileged Account ManagementNetwork SegmentationLimit Access to Resource Over NetworkApplication Isolation and Sandboxing

Tecnologías afectadas (1)

Freeswitch — Freeswitch

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-45771",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-45771",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-06-09T18:24:02.924387Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "signalwire",
          "product": "freeswitch",
          "versions": [
            {
              "status": "affected",
              "version": "< 1.11.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-06-09T17:17:33.303",
  "references": [
    {
      "url": "https://github.com/signalwire/freeswitch/releases/tag/v1.11.0",
      "tags": [
        "Product",
        "Release Notes"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/signalwire/freeswitch/security/advisories/GHSA-5vjg-pv56-vg4c",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-776"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.11.0, FreeSWITCH's bundled XML parser expands nested <!ENTITY> declarations without a depth or count bound, so a small DTD can describe a body that expands exponentially (\"billion laughs\"). The PIDF body of a SIP PUBLISH is fed to this parser before any digest check, letting an unauthenticated network attacker force unbounded CPU and memory consumption with a single request. This issue has been patched in version 1.11.0."
    },
    {
      "lang": "es",
      "value": "FreeSWITCH es una pila de telecomunicaciones definida por software que permite la transformación digital desde conmutadores de telecomunicaciones propietarios a una implementación de software que se ejecuta en cualquier hardware comercial. Antes de la versión 1.11.0, el analizador XML incluido de FreeSWITCH expande declaraciones <!ENTITY> anidadas sin un límite de profundidad o recuento, por lo que un DTD pequeño puede describir un cuerpo que se expande exponencialmente ('billion laughs'). El cuerpo PIDF de un SIP PUBLISH se alimenta a este analizador antes de cualquier verificación de digest, permitiendo a un atacante de red no autenticado forzar un consumo ilimitado de CPU y memoria con una única solicitud. Este problema ha sido parcheado en la versión 1.11.0."
    }
  ],
  "lastModified": "2026-07-20T20:10:00.110",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:freeswitch:freeswitch:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EB1371B3-3175-444B-B83A-B48D6CE8D760",
              "versionEndExcluding": "1.11.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}