A buffer overflow is triggered in FreeSWITCH’s libesl component when parsing the Content-Length header. The parsing routine uses atol() to convert the header value to an integer and passes that value directly to malloc(len+1) without validating its sign or magnitude. If an attacker supplies a negative Content-Length value, the conversion leads to an extremely large unsigned size for the malloc call or an under-allocated buffer, corrupting the heap of the receiving process. The overflow occurs before an ESL peer has authenticated, allowing an attacker to exploit the flaw in the initial communication phase. This defect can lead to arbitrary code execution or denial of service by crashing the process.

SignalWire FreeSWITCH software is affected. Versions released before 1.11.1 are vulnerable because the esl_recv_event() routine that parses the Content-Length header has not been patched. All deployments of FreeSWITCH that expose the ESL interface over the network and run a pre‑authentication version are at risk.

The flaw scores a 9.1 on the CVSS scale and is not yet listed in CISA’s KEV catalog. The EPSS score is currently unavailable, but the high impact score indicates the potential for widespread exploitation. The vulnerability can be abused by any party that can establish a connection to the ESL interface, sending a crafted frame with a negative Content-Length before the system authenticates the client. Since the flaw exists prior to authentication, it poses a significant risk to services that allow unauthenticated or poorly secured ESL connections. The lack of an official workaround suggests the primary mitigation is to apply the vendor’s patch immediately.