CVE-2021-41145

Katalog CVE

CVSS 7.5 · High EPSS 1,7%

Kerentanan Uncontrolled Resource Consumption pada freeswitch. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. FreeSWITCH prior to version 1.10.7 is susceptible to Denial of Service via SIP flooding. When flooding FreeSWITCH with SIP messages, it was observed that after a number of seconds the process was killed by the operating system due to memory exhaustion. By abusing this vulnerability, an attacker is able to crash any FreeSWITCH instance by flooding it with SIP messages, leading to Denial of Service. The attack does not require authentication and can be carried out over UDP, TCP or TLS. This issue was patched in version 1.10.7.

Rincian

Terbit di NVD

25 Oktober 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-400: Uncontrolled Resource Consumption
CWE-401: Missing Release of Memory after Effective Lifetime

EPSS (30 hari)

1,7% peluang dieksploitasi; lebih tinggi dari 75,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/signalwire/freeswitch/releases/tag/v1.10.7 release notes · advisory pihak ketiga
• https://github.com/signalwire/freeswitch/security/advisories/GHSA-jvpq-23v4-gp3m exploit · advisory pihak ketiga