# FreeSWITCH — CWE-407 Disclosure Brief
**2026-03-27 · Patch available — awaiting upstream merge**

## Finding

One high-severity defect in FreeSWITCH's conference mixing engine. `mod_conference.c` performs a per-sample relationship list scan per member pair inside the 50Hz audio mix thread, causing O(S×M²×R) overhead that compounds continuously during active conferences. Patch ready for upstream review.

## The Defects

**freeswitch-0001 (PATCHED — HIGH):** `mod_conference.c:651`

```c
/* Inside audio mix loop — 50Hz, per sample per member pair: */
for (member = conference->members; member; member = member->next) {
    /* Per-sample: scan relationship list for member pair */
    for (rel = member->relationships; rel; rel = rel->next) {
        /* O(R) relationship scan per sample per member */
        if (rel->member_id == other->id) { ... }
    }
}
/* O(S × M² × R) total in mix thread */
```

The relationship scan runs inside the audio sample processing loop: O(R) per sample, for every member-pair combination, at 50Hz. **Compound scaling: O(S × M² × R)** — unbounded under conference load.

## Complexity Proof

For M=10 members, R=5 relationships, S=8000 samples/sec at 50Hz mix rate:
- Per mix cycle: M² × R = 500 relationship scans × S/50 samples
- Fixed: pre-built `member_id → relationship*` hash per member
- High measured multiplier — scales super-linearly with conference size.

## Impact

All FreeSWITCH deployments running conferences. FreeSWITCH is a widely deployed open-source softswitch used in enterprise telephony, contact centers, and hosted PBX services. The mix thread runs continuously during every active conference at 50Hz. Larger conferences (many participants) hit M² scaling. Conference bridges with many concurrent conferences and relationships (mute/listen relationships, deaf/floor relationships) are most affected.

## The Fix

Pre-build a `member_id → relationship*` hash per member at relationship add/remove time:

```c
/* Before: O(R) scan per sample per member-pair */
for (rel = member->relationships; rel; rel = rel->next) {
    if (rel->member_id == other->id) { ... }
}

/* After */
/* CWE-407 fix: hash map for O(1) relationship lookup instead of O(R) scan. */
rel = switch_core_hash_find(member->relationship_hash, other->id_str);
if (rel) { ... }
```

## Patch

`defects/freeswitch/patch/freeswitch-0001-conference-rel-hashmap.patch`

## What We Ask

1. Confirm receipt and assign a GitHub Security Advisory or issue reference.
2. Validate the patch against your conference mixing test suite.
3. Assess CVE eligibility — fires continuously at 50Hz in every active conference.
4. Coordinate a disclosure date — we are targeting 90 days from first contact.

Contact: see cover email. This brief is confidential until coordinated disclosure.
