CVE-2026-49472: CWE-116: Improper Encoding or Escaping of Output in signalwire freeswitch
CVE-2026-49472 is a medium severity vulnerability in signalwire's FreeSWITCH software prior to version 1. 11. 0. It involves improper encoding or escaping of output in a function cloned from an outdated and vulnerable version of libexpat. This vulnerability has been patched in FreeSWITCH version 1. 11. 0.
AI Analysis
Technical Summary
FreeSWITCH versions before 1.11.0 include a vulnerable function PREFIX(prologTok)() in libs/xmlrpc-c/lib/expat/xmltok/xmltok_impl.c, which was cloned from an outdated and vulnerable libexpat source that did not receive a corresponding security patch. This improper encoding or escaping of output (CWE-116) could lead to potential issues. The vulnerability is addressed by a patch in version 1.11.0.
Potential Impact
The CVSS 3.1 base score is 5.3 (medium), indicating a vulnerability that requires network access with high attack complexity and low privileges, no user interaction, and impacts availability but not confidentiality or integrity. There are no known exploits in the wild. The impact is limited to potential availability issues without direct confidentiality or integrity compromise.
Mitigation Recommendations
A fix is available in FreeSWITCH version 1.11.0. Users should upgrade to version 1.11.0 or later to remediate this vulnerability. No other mitigation guidance is provided or necessary based on the available data.
CVE-2026-49472: CWE-116: Improper Encoding or Escaping of Output in signalwire freeswitch
Description
CVE-2026-49472 is a medium severity vulnerability in signalwire's FreeSWITCH software prior to version 1. 11. 0. It involves improper encoding or escaping of output in a function cloned from an outdated and vulnerable version of libexpat. This vulnerability has been patched in FreeSWITCH version 1. 11. 0.
CVSS v3.1
Score 5.3medium
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
FreeSWITCH versions before 1.11.0 include a vulnerable function PREFIX(prologTok)() in libs/xmlrpc-c/lib/expat/xmltok/xmltok_impl.c, which was cloned from an outdated and vulnerable libexpat source that did not receive a corresponding security patch. This improper encoding or escaping of output (CWE-116) could lead to potential issues. The vulnerability is addressed by a patch in version 1.11.0.
Potential Impact
The CVSS 3.1 base score is 5.3 (medium), indicating a vulnerability that requires network access with high attack complexity and low privileges, no user interaction, and impacts availability but not confidentiality or integrity. There are no known exploits in the wild. The impact is limited to potential availability issues without direct confidentiality or integrity compromise.
Mitigation Recommendations
A fix is available in FreeSWITCH version 1.11.0. Users should upgrade to version 1.11.0 or later to remediate this vulnerability. No other mitigation guidance is provided or necessary based on the available data.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-30T04:17:43.094Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a283e988dd33fbd8553f3f3
Added to database: 6/9/2026, 4:26:00 PM
Last enriched: 6/9/2026, 4:41:48 PM
Last updated: 6/10/2026, 5:08:59 AM
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.