The vulnerability arises when mod_event_socket accepts an unauthenticated Content-Length header values – negative or excessively large – and uses that value directly to allocate memory for the event socket message body. This can cause an integer overflow in the terminator calculation or trigger an abort in a helper function, resulting in the FreeSWITCH process terminating. The consequence is a denial‑of‑service that drops all active calls until the service is restarted.

The flaw affects the SignalWire FreeSWITCH product, specifically all releases prior to version 1.11.2. Any installation that allows a host via apply‑inbound‑acl or connects outbound to a hostile application server could trigger the crash.

The CVSS score of 7.5 denotes high severity, and the exploit path is exploitable before authentication using a crafted Content‑Length header. Because the header is parsed before the event‑socket password, an attacker who can reach the event socket endpoint – either locally (default loopback ACL limits ordinary installations) or remotely via an accepted application server – can send malicious requests that cause a process abort. The EPSS score is unavailable, and the vulnerability is not yet in the CISA KEV catalog, but the high CVSS and remote‑pre‑auth nature suggest a significant risk for exposed installations.