CVE-2021-41145

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. FreeSWITCH prior to version 1.10.7 is susceptible to Denial of Service via SIP flooding. When flooding FreeSWITCH with SIP messages, it was observed that after a number of seconds the process was killed by the operating system due to memory exhaustion. By abusing this vulnerability, an attacker is able to crash any FreeSWITCH instance by flooding it with SIP messages, leading to Denial of Service. The attack does not require authentication and can be carried out over UDP, TCP or TLS. This issue was patched in version 1.10.7.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400CWE-401

Affected software

No affected versions have been published.

Timeline

Published
Oct 25, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-411468.8qutebrowser is an open source keyboard-focused browser with a minimal GUI. Starting with qutebrowser v1.7.0, the Windows installer for qutebCVE-2021-411477.2Tuleap Open ALM is a libre and open source tool for end to end traceability of application and system developments. Prior to version 11.16.9CVE-2021-411488.8Tuleap Open ALM is a libre and open source tool for end to end traceability of application and system developments. Prior to version 11.16.9CVE-2021-411498.1Tough provides a set of Rust libraries and tools for using and generating the update framework (TUF) repositories. The tough library, prior CVE-2021-41155.5There is a flaw in polkit which can allow an unprivileged user to cause polkit to crash, due to process file descriptor exhaustion. The highCVE-2021-411506.5Tough provides a set of Rust libraries and tools for using and generating the update framework (TUF) repositories. The tough library, prior CVE-2021-411514.9Backstage is an open platform for building developer portals. In affected versions A malicious actor could read sensitive files from the envCVE-2021-411527.7OpenOlat is a web-based e-learning platform for teaching, learning, assessment and communication, an LMS, a learning management system. In aCVE-2021-411539.8The evm crate is a pure Rust implementation of Ethereum Virtual Machine. In `evm` crate `< 0.31.0`, `JUMPI` opcode's condition is checked afCVE-2021-411548.8Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. In affected versions an attacker withCVE-2021-411558.8Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. In affected versions Tuleap does not CVE-2021-411565.4anuko/timetracker is an, open source time tracking system. In affected versions Time Tracker uses browser_today hidden control on a few page
CVE-2021-41145: High severity, CVSS 7.5 | Vulnix