CVE-2021-41145

    Dashboard / Vulnerabilities / CVE-2021-41145

    CVE-2021-41145

    Published: 25 Oct 2021Last Modified: 9 Jul 2026

    Summary:

    Details: FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. FreeSWITCH prior to version 1.10.7 is susceptible to Denial of Service via SIP flooding. When flooding FreeSWITCH with SIP messages, it was observed that after a number of seconds the process was killed by the operating system due to memory exhaustion. By abusing this vulnerability, an attacker is able to crash any FreeSWITCH instance by flooding it with SIP messages, leading to Denial of Service. The attack does not require authentication and can be carried out over UDP, TCP or TLS. This issue was patched in version 1.10.7.

    References: https://github.com/signalwire/freeswitch/releases/tag/v1.10.7, https://github.com/signalwire/freeswitch/security/advisories/GHSA-jvpq-23v4-gp3m

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -883d2cb662bed0316e157bd3beb9853e96c60d02

    Affected versions

    v1.10.6
    v1.10.5
    v1.10.4
    v1.10.3
    v1.10.2
    v1.10.1
    v1.10.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2021-41145 | CVE-DB