FreeSWITCH — CWE-407 Disclosure Brief

2026-03-27 · Patch available — awaiting upstream merge

Finding

One high-severity defect in FreeSWITCH's conference mixing engine. mod_conference.c performs a per-sample relationship list scan per member pair inside the 50Hz audio mix thread, causing O(S×M²×R) overhead that compounds continuously during active conferences. Patch ready for upstream review.

The Defects

freeswitch-0001 (PATCHED — HIGH): mod_conference.c:651

/* Inside audio mix loop — 50Hz, per sample per member pair: */
for (member = conference->members; member; member = member->next) {
    /* Per-sample: scan relationship list for member pair */
    for (rel = member->relationships; rel; rel = rel->next) {
        /* O(R) relationship scan per sample per member */
        if (rel->member_id == other->id) { ... }
    }
}
/* O(S × M² × R) total in mix thread */

The relationship scan runs inside the audio sample processing loop: O(R) per sample, for every member-pair combination, at 50Hz. Compound scaling: O(S × M² × R) — unbounded under conference load.

Complexity Proof

For M=10 members, R=5 relationships, S=8000 samples/sec at 50Hz mix rate:

Per mix cycle: M² × R = 500 relationship scans × S/50 samples
Fixed: pre-built member_id → relationship* hash per member
High measured multiplier — scales super-linearly with conference size.

Impact

All FreeSWITCH deployments running conferences. FreeSWITCH is a widely deployed open-source softswitch used in enterprise telephony, contact centers, and hosted PBX services. The mix thread runs continuously during every active conference at 50Hz. Larger conferences (many participants) hit M² scaling. Conference bridges with many concurrent conferences and relationships (mute/listen relationships, deaf/floor relationships) are most affected.

The Fix

Pre-build a member_id → relationship* hash per member at relationship add/remove time:

/* Before: O(R) scan per sample per member-pair */
for (rel = member->relationships; rel; rel = rel->next) {
    if (rel->member_id == other->id) { ... }
}

/* After */
/* CWE-407 fix: hash map for O(1) relationship lookup instead of O(R) scan. */
rel = switch_core_hash_find(member->relationship_hash, other->id_str);
if (rel) { ... }

Patch

defects/freeswitch/patch/freeswitch-0001-conference-rel-hashmap.patch

What We Ask

Confirm receipt and assign a GitHub Security Advisory or issue reference.
Validate the patch against your conference mixing test suite.
Assess CVE eligibility — fires continuously at 50Hz in every active conference.
Coordinate a disclosure date — we are targeting 90 days from first contact.

Contact: see cover email. This brief is confidential until coordinated disclosure.

2.8 KiB Raw Blame History Unescape Escape