LoginSign Up
← Back to all sparks
F

FreeSWITCH

MEETINGS
Velocity2.5

Software-defined telecom stack for voice, video and messaging.

signalwire.com/freeswitch ↗

With the legacy purge done, FreeSWITCH spent 1.11.2 bounds-checking everything that parses bytes

voiptelephonysecurity-hardeninglegacy-removalsipwebrtc
◆Current state
FreeSWITCH shipped 1.11.2 in August 2026, three months after the 1.11.0 branch cut that removed roughly thirty modules and migrated the regex engine to PCRE2. Where 1.11.0 was about deleting surface area, 1.11.2 is about auditing what remains: nearly every bug line is a bounds or length check in a parser — STUN attributes, base64 decode, XML entity decoding, RTMP H.264 NAL units, XML-RPC WebSocket frames, MSRP body lengths. Alongside the fixes it adds an interface allowlist and turns on DTLS client-certificate verification against the SDP fingerprint plus opt-in STUN MESSAGE-INTEGRITY checks on inbound ICE. The build system continues moving off self-hosted infrastructure onto GitHub-published artifacts and upstream packages.
◆Where it's heading
The 1.11.x line reads as a deliberate two-step: cut the maintenance surface, then harden what is left. Having removed thirty modules, the project can now afford to audit the media and signaling paths line by line, and the pattern of fixes — untrusted length fields reaching memory writes — suggests a systematic pass rather than incremental reports. The parallel thread is dependency modernization: mod_v8 moved from a custom v8-6.1 fork to upstream libnode, SpanDSP and libvpx were bumped, and Windows builds now pull pre-compiled FFmpeg and libcodec2 rather than building them. Both threads point the same direction — less bespoke code to own.
◆Prediction
Expect the hardening pass to continue into the remaining parsers, with the opt-in STUN MESSAGE-INTEGRITY check becoming default once operators have shipped through a release. The build-system migration off files.freeswitch.org appears partway done, so the next release likely finishes moving the remaining assets to GitHub-hosted artifacts.

◆Recent moves

  1. 9d ago

    Interface allowlist lands with a broad memory-safety sweep

    The follow-through on 1.11.0's pruning: roughly twenty bounds and length fixes across the core STUN and base64 paths, mod_rtmp's H.264 parsing, and mod_xml_rpc's WebSocket frame parser. New operator-facing controls are narrow but real — an interface allowlist, DTLS client-certificate verification against the SDP fingerprint, and opt-in STUN MESSAGE-INTEGRITY on inbound ICE checks. Continues the dependency cleanup with mod_v8 moving to upstream libnode on both Windows and Linux.

    View source ↗
  2. 2mo ago

    Hot TLS certificate reloads and SIP 603 passthrough

    The reloadcert API lets mod_sofia and mod_verto pick up new TLS certificates without dropping connections, removing a restart from the certificate rotation path operators run on a schedule. The rest is corrective — a use-after-free in the session thread pool, a heap overflow in mod_verto's HTTP POST body read, and auth gating fixes that block cross-identity session eviction. Sits between 1.11.0's structural cut and 1.11.2's systematic hardening.

    View source ↗
  3. 3mo ago

    PCRE2, OpenSSL 3 on Windows, and thirty legacy modules removed

    ⚡ SPARK

    The branch cut that defines the current arc: roughly thirty modules removed from the tree and the regex engine migrated to PCRE2 with breaking changes called out explicitly. Everything since — the reloadcert work in 1.11.1, the parser audit in 1.11.2 — is only tractable because this release shrank what there is to maintain.

    View source ↗
  4. 2y ago

    ARM64 support arrives, Debian 10 and CentOS dropped

    ARM64 packaging opens the platform to a hardware class the project had not shipped builds for, while Debian 10 Buster and CentOS support come out. The same add-one-platform-drop-two trade recurs through the 1.10 line and prefigures the larger cut in 1.11.0.

    View source ↗
  5. 2y ago

    Coverity fixes and a sofia-sip version bump

    Almost entirely static-analysis cleanup — null-check ordering, unchecked returns, dead code — plus a sofia-sip requirement bump. The DTLS source-path rejection and ICE route fix matter to anyone chasing media issues, but nothing here changes what the platform does.

    View source ↗
  6. 3y ago

    Debian 12, OpenSSL 3 and FFmpeg 5 support

    Keeps the platform installable on current distributions with Debian 12 Bookworm, OpenSSL 3 and FFmpeg 5 support, paired with a macOS static-analysis pass across the core and most modules. Routine platform maintenance, but the kind that determines whether the project stays deployable at all.

    View source ↗