WarmTransfer
sip media · published

FreeSWITCH

Verified 2026-09-24 · 60 sources · tier 2–3

Also known as FreeSWITCH.

FreeSWITCH ships in two editions: open-source FreeSWITCH distributed through GitHub releases, and FreeSWITCH Enterprise, a commercially supported edition from SignalWire that requires a subscription 19. The FreeSWITCH Users Manual states that every parameter, value, and default it documents is verified against the FreeSWITCH source and the shipped default configuration 28.

Installation and Configuration

Open-source FreeSWITCH is licensed under the Mozilla Public License version 1.1 (MPL 1.1) 26. Installing FreeSWITCH from the Debian/Ubuntu package repository requires a SignalWire Personal Access Token, obtained by creating a SignalWire Space and signing in 33. Building FreeSWITCH from the GitHub source does not require a SignalWire token 46.

The FreeSWITCH configuration directory is /etc/freeswitch for a distribution-package install and /usr/local/freeswitch/conf for a default source build 7. The vanilla FreeSWITCH configuration sets a shared default_password of 1234 in vars.xml, and the manual says to change it before exposing FreeSWITCH to any untrusted network 10. The vanilla FreeSWITCH directory defines 20 test users, extensions 1000 through 1019 in the default domain, all sharing the default password 47.

Module Management

Which FreeSWITCH modules get compiled is decided at build time by build/modules.conf.in, where uncommented lines cause a module to be built as a shared library 31. At startup, FreeSWITCH loads the installed modules listed as load elements in autoload_configs/modules.conf.xml 32. FreeSWITCH processes pre_load_modules.conf.xml first (typically database drivers such as mod_pgsql), then modules.conf.xml, then post_load_modules.conf.xml 30.

From fs_cli, load, unload, and reload (unload then load) act on a module without restarting FreeSWITCH, and show modules lists the loaded modules 41.

SIP Architecture and Gateways

mod_sofia is the main FreeSWITCH SIP endpoint module and is built on the Sofia-SIP stack 29. FreeSWITCH ships 2 SIP profiles: internal on port 5060 (via internal_sip_port) for registered endpoints, and external on port 5080 (via external_sip_port) for carrier trunks 11. In the shipped profiles, auth-calls (digest authentication of INVITEs) is true on the internal profile and false on the external profile 34.

SIP profile XML files live in conf/sip_profiles/, and sofia.conf.xml in autoload_configs pulls them in with an X-PRE-PROCESS include of ../sip_profiles/*.xml 36. The Sofia profile parameters ext-sip-ip and ext-rtp-ip set the public SIP and RTP addresses FreeSWITCH advertises behind NAT; sip-ip and rtp-ip set the local bind addresses 37. The Sofia profile context parameter names the dialplan context for inbound calls on that profile; the internal profile ships with context public 35.

A FreeSWITCH gateway is a named outbound SIP trunk defined in a Sofia profile's gateways block that tells the endpoint how to reach a remote provider or peer and can optionally register an account there 21. In the vanilla layout, gateway XML files go in conf/sip_profiles/external/ and are included into the external profile's gateways section by an X-PRE-PROCESS include 23. The gateway ping parameter makes FreeSWITCH send a SIP OPTIONS request to the gateway every N seconds as a keepalive 24. To send a call out a gateway, the dialplan bridge application uses the endpoint string sofia/gateway/<name>/<number>, where <name> must match the gateway's name attribute exactly 22.

Dialplan Structure and Execution

The FreeSWITCH XML dialplan nests elements as context, then extension, then condition, then action or anti-action 17. The vanilla configuration's dialplan in conf/dialplan/ provides 3 contexts: default, public, and features 15.

mod_dialplan_xml checks a context's extensions in document order and runs the actions of the first extension whose conditions all match; continue="true" on an extension lets evaluation go on to the next extension after a match 16. A dialplan condition's break attribute defaults to on-false, so a failed condition stops evaluation of that extension; the other values are on-true, always, and never 12. Capture groups in a condition's expression become $1 through $N in later action data, and the full match is available as ${DP_MATCH} 13. Actions marked inline, such as set or export, run immediately while the dialplan is being evaluated instead of being queued 18.

Unauthenticated inbound calls enter the dialplan context named by the SIP profile's context parameter, while calls from authenticated directory users enter the context in that user's user_context variable 14. The public context acts as a security perimeter: it accepts only specific destination numbers and transfers them into the default context 38.

WebRTC and Verto

Verto is a FreeSWITCH signalling protocol of JSON-RPC over WebSocket that lets browser and other WebRTC endpoints register with FreeSWITCH and make and receive calls without a SIP stack 56. Verto needs mod_rtc and mod_verto both loaded in modules.conf.xml, with mod_rtc listed first; it is configured in verto.conf.xml 58.

The standard Verto profile is named default-v4 and conventionally listens for plain WebSocket on port 8081 and secure WebSocket (WSS) on 8082; a bind-local marked secure="true" makes a WSS binding 59. Verto WSS takes a single combined PEM file via the secure-combined parameter, typically $${certs_dir}/wss.pem; DTLS-SRTP media uses a separate dtls-srtp.pem 55. Verto authenticates users against the existing FreeSWITCH directory XML user database 57. Verto uses the same core media engine (mod_rtc plus switch_core_media) as SIP over WSS, so both share the same DTLS-SRTP and ICE media path 60.

CLI and Management

FreeSWITCH exposes its runtime API through 2 interfaces that share 1 command set: the interactive fs_cli console and the Event Socket 6. fs_cli connects to a running FreeSWITCH over the Event Socket, which listens by default on port 8021 on all interfaces (::) with the password ClueCon 20.

The reloadxml command reloads all XML configuration from disk without restarting FreeSWITCH 40. sofia status lists all profiles and gateways, and sofia status profile <name> reg shows registrations on that profile, optionally filtered by a contact string 45. sofia global siptrace on|off turns SIP message trace logging on or off for all profiles from fs_cli 43.

Releases and Vulnerabilities

The last 1.10.x release, v1.10.12, was published 2024-08-03, and the next release was v1.11.0 on 2026-05-07 48. FreeSWITCH v1.11.0 moved to the PCRE2 regular-expression library, and its release notes warn of breaking changes 50. FreeSWITCH v1.11.0 removed roughly 30 legacy modules, including mod_python, mod_rayo, mod_khomp, mod_gsmopen, mod_skypopen, mod_portaudio, and mod_yaml 51. FreeSWITCH v1.11.0 added support for Debian 13 Trixie 49.

FreeSWITCH v1.11.1 added a reloadcert API that reloads TLS certificates in mod_sofia and mod_verto without disconnecting 52. FreeSWITCH v1.11.2 added an interface allowlist in core and mod_commands and tightened DTLS and STUN validation, including checking a DTLS client certificate against the SDP fingerprint in the server role 53. As of 2026-09-24, the newest open-source FreeSWITCH release is v1.11.3, published 2026-08-28 25. FreeSWITCH v1.11.3 drops Debian 11 Bullseye and is described as containing critical security fixes and stability improvements 54.

CVE-2026-45771 (GHSA-5vjg-pv56-vg4c, CVSS 7.5) lets a SIP PUBLISH with nested XML entities exhaust CPU and memory through mod_sofia's presence handling; it affects 1.10.12 and earlier and is fixed in 1.11.0 8. Until upgrading, the advisory for CVE-2026-45771 suggests limiting affected SIP listeners to trusted networks, or setting manage-presence=false on untrusted profiles, which also disables presence features such as BLF 39. CVE-2026-49841 (GHSA-wfrq-qvg2-f88f, CVSS 9.8) is a heap buffer overflow in mod_verto's HTTP POST body handling that can be triggered before authentication; it affects FreeSWITCH 1.11.0 and earlier and is fixed in 1.11.1 9. WarmTransfer's reading of the sources is that a deployment still on FreeSWITCH 1.10.x has no open-source release fixing CVE-2026-45771 or CVE-2026-49841 on its own branch and has to move to 1.11.1 or later to pick up both fixes 1.

FreeSWITCH vulnerabilities are to be reported privately to security@signalwire.com under a responsible-disclosure process 42.

Comparison with Asterisk

Asterisk is distributed under the GNU General Public License version 2, and alternative licences can also be negotiated directly with Sangoma US Inc 5. Asterisk deprecated its chan_sip driver in Asterisk 17 and removed it in Asterisk 21; PJSIP (res_pjsip/chan_pjsip) is the standard SIP driver 4. Asterisk 22 is an LTS series released 2024-10-16, with security fixes only from 2028-10-16 and end of life on 2029-10-16 2. The Asterisk versions table lists Asterisk 24 as a pre-release LTS scheduled for 2026-10-15, with EOL on 2031-10-15 3. WarmTransfer's reading of the sources is that Asterisk publishes per-series LTS, security-fix-only, and EOL dates, but no comparable published lifecycle table for open-source FreeSWITCH release lines turned up in the sources reviewed 27.

Applicability

Applies to: SignalWire FreeSWITCH and Sangoma Asterisk. Deployments: cloud and on-premises. Sources checked 2026-09-24. The newest open-source release covered is v1.11.3, published 2026-08-28 25. Debian 11 Bullseye support is dropped in v1.11.3 54, and Debian 13 Trixie support was added in v1.11.0 49.

What remains uncertain

Whether SignalWire backports security fixes to 1.10.x (open source or Enterprise) and any published support lifecycle is not covered by the sources below. Sofia NAT handling, including ext-rtp-ip and ext-sip-ip value forms (autonat:, stun:, host:) and NAT detection parameters, is not covered by the sources below. The configuration and scope of the v1.11.2 interface allowlist is not covered by the sources below. The FreeSWITCH Enterprise feature set, pricing, and support terms versus open source are not covered by the sources below. Which Sofia profile parameters apply on rescan versus requiring a restart and their effect on live calls are not covered by the sources below. Mapping Sofia gateway and profile concepts to Asterisk PJSIP endpoint, AOR, auth, and registration objects is not covered by the sources below. Gateway state values (REGED, NOREG, FAIL_WAIT, etc.) and sofia status gateway or killgw usage are not covered by the sources below. Sofia ws-binding and wss-binding parameters and default ports for SIP over WebSocket are not covered by the sources below.

See also

Related to

Referenced by

Sources

  1. 1
    A deployment still on FreeSWITCH 1.10.x has no open-source release fixing CVE-2026-45771 or CVE-2026-49841 on its own branch and has to move to 1.11.1 or later to pick up both fixes.inferred
    GitHub REST API: signalwire/freeswitch releases (6 most recent) · Release list: no 1.10.x tag after v1.10.12 (2024-08-03); combined with the patched-version fields of both advisories · Checked 2026-09-24
  2. 2
    Asterisk 22 is an LTS series released 2024-10-16, with security fixes only from 2028-10-16 and end of life on 2029-10-16.
    Asterisk Versions · Release series table, 22.x row · Checked 2026-09-24
  3. 3
    The Asterisk versions table lists Asterisk 24 as a pre-release LTS scheduled for 2026-10-15, with EOL on 2031-10-15.
    Asterisk Versions · Release series table, 24.x row · Checked 2026-09-24
  4. 4
    Asterisk deprecated its chan_sip driver in Asterisk 17 and removed it in Asterisk 21; PJSIP (res_pjsip/chan_pjsip) is the standard SIP driver.
    Configuring chan_sip · Configuring chan_sip page, deprecation/removal notice · Checked 2026-09-24
  5. 5
    Asterisk is distributed under the GNU General Public License version 2, and alternative licences can also be negotiated directly with Sangoma US Inc.
    Asterisk LICENSE file (master branch) · LICENSE file, opening paragraphs · Checked 2026-09-24
  6. 6
    FreeSWITCH exposes its runtime API through two interfaces that share one command set: the interactive fs_cli console and the Event Socket.
    Chapter 31: CLI and API Command Reference | FreeSWITCH Users Manual · Chapter 31, opening paragraph · Checked 2026-09-24
  7. 7
    The FreeSWITCH configuration directory is /etc/freeswitch for a distribution-package install and /usr/local/freeswitch/conf for a default source build.
    Chapter 2: Getting Started | FreeSWITCH Users Manual · Chapter 2, default installation paths table · Checked 2026-09-24
  8. 8
    CVE-2026-45771 (GHSA-5vjg-pv56-vg4c, CVSS 7.5) lets a SIP PUBLISH with nested XML entities exhaust CPU and memory through mod_sofia's presence handling; it affects 1.10.12 and earlier and is fixed in 1.11.0.
    Denial-of-Service in SIP PUBLISH Requests via XML Entity Expansion · Advisory header and key details · Checked 2026-09-24
  9. 9
    CVE-2026-49841 (GHSA-wfrq-qvg2-f88f, CVSS 9.8) is a heap buffer overflow in mod_verto's HTTP POST body handling that can be triggered before authentication; it affects FreeSWITCH 1.11.0 and earlier and is fixed in 1.11.1.
    Pre-authentication heap buffer overflow in mod_verto HTTP POST body read · Advisory header (affected/patched versions, severity, CVE) and description · Checked 2026-09-24
  10. 10
    The vanilla FreeSWITCH configuration sets a shared default_password of 1234 in vars.xml, and the manual says to change it before exposing FreeSWITCH to any untrusted network.
    Chapter 2: Getting Started | FreeSWITCH Users Manual · Chapter 2, default configuration security section · Checked 2026-09-24
  11. 11
    FreeSWITCH ships two SIP profiles: internal on port 5060 (via internal_sip_port) for registered endpoints, and external on port 5080 (via external_sip_port) for carrier trunks.
    Chapter 7: SIP Profiles with Sofia | FreeSWITCH Users Manual · Chapter 7, default profiles: internal profile and external profile · Checked 2026-09-24
  12. 12
    A dialplan condition's break attribute defaults to on-false, so a failed condition stops evaluation of that extension; the other values are on-true, always and never.
    Chapter 12: The XML Dialplan | FreeSWITCH Users Manual · Chapter 12, routing logic: condition evaluation · Checked 2026-09-24
  13. 13
    Capture groups in a condition's expression become $1 through $N in later action data, and the full match is available as ${DP_MATCH}.
    Chapter 12: The XML Dialplan | FreeSWITCH Users Manual · Chapter 12, capture and variable substitution · Checked 2026-09-24
  14. 14
    Unauthenticated inbound calls enter the dialplan context named by the SIP profile's context parameter, while calls from authenticated directory users enter the context in that user's user_context variable.
    Chapter 12: The XML Dialplan | FreeSWITCH Users Manual · Chapter 12, context assignment · Checked 2026-09-24
  15. 15
    The vanilla configuration's dialplan in conf/dialplan/ provides three contexts: default, public and features.
    Chapter 12: The XML Dialplan | FreeSWITCH Users Manual · Chapter 12, file organization · Checked 2026-09-24
  16. 16
    mod_dialplan_xml checks a context's extensions in document order and runs the actions of the first extension whose conditions all match; continue="true" on an extension lets evaluation go on to the next extension after a match.
    Chapter 12: The XML Dialplan | FreeSWITCH Users Manual · Chapter 12, routing logic: extension matching · Checked 2026-09-24
  17. 17
    The FreeSWITCH XML dialplan nests elements as context, then extension, then condition, then action or anti-action.
    Chapter 12: The XML Dialplan | FreeSWITCH Users Manual · Chapter 12, core structure · Checked 2026-09-24
  18. 18
    Actions marked inline, such as set or export, run immediately while the dialplan is being evaluated instead of being queued.
    Chapter 12: The XML Dialplan | FreeSWITCH Users Manual · Chapter 12, key applications: inline actions · Checked 2026-09-24
  19. 19
    FreeSWITCH ships in two editions: open-source FreeSWITCH distributed through GitHub releases, and FreeSWITCH Enterprise, a commercially supported edition from SignalWire that requires a subscription.
    FreeSWITCH Users Manual · Users Manual landing page, editions section · Checked 2026-09-24
  20. 20
    fs_cli connects to a running FreeSWITCH over the Event Socket, which listens by default on port 8021 on all interfaces (::) with the password ClueCon.
    Chapter 31: CLI and API Command Reference | FreeSWITCH Users Manual · Chapter 31, connection details · Checked 2026-09-24
  21. 21
    A FreeSWITCH gateway is a named outbound SIP trunk defined in a Sofia profile's gateways block that tells the endpoint how to reach a remote provider or peer and can optionally register an account there.
    Chapter 8: Gateways and Trunk Registration | FreeSWITCH Users Manual · Chapter 8, gateway definition (opening section) · Checked 2026-09-24
  22. 22
    To send a call out a gateway, the dialplan bridge application uses the endpoint string sofia/gateway/<name>/<number>, where <name> must match the gateway's name attribute exactly.
    Chapter 8: Gateways and Trunk Registration | FreeSWITCH Users Manual · Chapter 8, outbound call routing · Checked 2026-09-24
  23. 23
    In the vanilla layout, gateway XML files go in conf/sip_profiles/external/ and are included into the external profile's gateways section by an X-PRE-PROCESS include.
    Chapter 8: Gateways and Trunk Registration | FreeSWITCH Users Manual · Chapter 8, gateway file location · Checked 2026-09-24
  24. 24
    The gateway ping parameter makes FreeSWITCH send a SIP OPTIONS request to the gateway every N seconds as a keepalive.
    Chapter 8: Gateways and Trunk Registration | FreeSWITCH Users Manual · Chapter 8, key parameters table: ping row · Checked 2026-09-24
  25. 25
    As of 2026-09-24 the newest open-source FreeSWITCH release is v1.11.3, published 2026-08-28.
    GitHub REST API: signalwire/freeswitch releases (6 most recent) · JSON element tag_name v1.11.3, field published_at · Checked 2026-09-24
  26. 26
    Open-source FreeSWITCH is licensed under the Mozilla Public License version 1.1 (MPL 1.1).
    FreeSWITCH LICENSE file (master branch) · LICENSE file header · Checked 2026-09-24
  27. 27
    Asterisk publishes per-series LTS, security-fix-only and EOL dates, but no comparable published lifecycle table for open-source FreeSWITCH release lines turned up in the sources reviewed.inferred
    Asterisk Versions · Release series table (Asterisk side); FreeSWITCH absence judged from gh-signalwire-freeswitch-security-advisories policy text and the Users Manual landing page · Checked 2026-09-24
  28. 28
    The FreeSWITCH Users Manual states that every parameter, value and default it documents is verified against the FreeSWITCH source and the shipped default configuration.
    FreeSWITCH Users Manual · Users Manual landing page, introductory text · Checked 2026-09-24
  29. 29
    mod_sofia is the main FreeSWITCH SIP endpoint module and is built on the Sofia-SIP stack.
    mod_sofia — SIP Endpoint (Sofia) | FreeSWITCH Users Manual · Part 9 module reference, mod_sofia entry · Checked 2026-09-24
  30. 30
    FreeSWITCH processes pre_load_modules.conf.xml first (typically database drivers such as mod_pgsql), then modules.conf.xml, then post_load_modules.conf.xml.
    Chapter 5: Module Loading and Management | FreeSWITCH Users Manual · Chapter 5, module loading process · Checked 2026-09-24
  31. 31
    Which FreeSWITCH modules get compiled is decided at build time by build/modules.conf.in, where uncommented lines cause a module to be built as a shared library.
    Chapter 5: Module Loading and Management | FreeSWITCH Users Manual · Chapter 5, configuration files and locations: build time · Checked 2026-09-24
  32. 32
    At startup FreeSWITCH loads the installed modules listed as load elements in autoload_configs/modules.conf.xml.
    Chapter 5: Module Loading and Management | FreeSWITCH Users Manual · Chapter 5, configuration files and locations: runtime · Checked 2026-09-24
  33. 33
    Installing FreeSWITCH from the Debian/Ubuntu package repository requires a SignalWire Personal Access Token, obtained by creating a SignalWire Space and signing in.
    Chapter 2: Getting Started | FreeSWITCH Users Manual · Chapter 2, package installation section · Checked 2026-09-24
  34. 34
    In the shipped profiles, auth-calls (digest authentication of INVITEs) is true on the internal profile and false on the external profile.
    Chapter 7: SIP Profiles with Sofia | FreeSWITCH Users Manual · Chapter 7, critical profile parameters table, auth-calls row · Checked 2026-09-24
  35. 35
    The Sofia profile context parameter names the dialplan context for inbound calls on that profile; the internal profile ships with context public.
    Chapter 7: SIP Profiles with Sofia | FreeSWITCH Users Manual · Chapter 7, critical profile parameters table, context row · Checked 2026-09-24
  36. 36
    SIP profile XML files live in conf/sip_profiles/, and sofia.conf.xml in autoload_configs pulls them in with an X-PRE-PROCESS include of ../sip_profiles/*.xml.
    Chapter 7: SIP Profiles with Sofia | FreeSWITCH Users Manual · Chapter 7, file organization · Checked 2026-09-24
  37. 37
    The Sofia profile parameters ext-sip-ip and ext-rtp-ip set the public SIP and RTP addresses FreeSWITCH advertises behind NAT; sip-ip and rtp-ip set the local bind addresses.
    Chapter 7: SIP Profiles with Sofia | FreeSWITCH Users Manual · Chapter 7, critical profile parameters table · Checked 2026-09-24
  38. 38
    The public context acts as a security perimeter: it accepts only specific destination numbers and transfers them into the default context.
    Chapter 12: The XML Dialplan | FreeSWITCH Users Manual · Chapter 12, public context discussion · Checked 2026-09-24
  39. 39
    Until they can upgrade, the advisory for CVE-2026-45771 suggests limiting affected SIP listeners to trusted networks, or setting manage-presence=false on untrusted profiles, which also disables presence features such as BLF.
    Denial-of-Service in SIP PUBLISH Requests via XML Entity Expansion · Advisory, mitigation section · Checked 2026-09-24
  40. 40
    The reloadxml command reloads all XML configuration from disk without restarting FreeSWITCH.
    Chapter 31: CLI and API Command Reference | FreeSWITCH Users Manual · Chapter 31, configuration management: reloadxml · Checked 2026-09-24
  41. 41
    From fs_cli, load, unload and reload (unload then load) act on a module without restarting FreeSWITCH, and show modules lists the loaded modules.
    Chapter 5: Module Loading and Management | FreeSWITCH Users Manual · Chapter 5, runtime commands table · Checked 2026-09-24
  42. 42
    FreeSWITCH vulnerabilities are to be reported privately to security@signalwire.com under a responsible-disclosure process.
    Security overview · signalwire/freeswitch · Security policy section · Checked 2026-09-24
  43. 43
    sofia global siptrace on|off turns SIP message trace logging on or off for all profiles from fs_cli.
    Chapter 31: CLI and API Command Reference | FreeSWITCH Users Manual · Chapter 31, SIP profile control: sofia global siptrace · Checked 2026-09-24
  44. 44
    sofia profile <name> rescan re-reads the profile configuration from XML without a full restart, whereas sofia profile <name> restart fully stops and restarts the profile.
    Chapter 31: CLI and API Command Reference | FreeSWITCH Users Manual · Chapter 31, SIP profile control: sofia profile commands · Checked 2026-09-24
  45. 45
    sofia status lists all profiles and gateways, and sofia status profile <name> reg shows registrations on that profile, optionally filtered by a contact string.
    Chapter 31: CLI and API Command Reference | FreeSWITCH Users Manual · Chapter 31, SIP profile control · Checked 2026-09-24
  46. 46
    Building FreeSWITCH from the GitHub source does not require a SignalWire token.
    Chapter 2: Getting Started | FreeSWITCH Users Manual · Chapter 2, source build section · Checked 2026-09-24
  47. 47
    The vanilla FreeSWITCH directory defines twenty test users, extensions 1000 through 1019 in the default domain, all sharing the default password.
    Chapter 2: Getting Started | FreeSWITCH Users Manual · Chapter 2, default test extensions section · Checked 2026-09-24
  48. 48
    The last 1.10.x release, v1.10.12, was published 2024-08-03, and the next release was v1.11.0 on 2026-05-07.
    GitHub REST API: signalwire/freeswitch releases (6 most recent) · JSON elements tag_name v1.10.12 and v1.11.0, field published_at · Checked 2026-09-24
  49. 49
    FreeSWITCH v1.11.0 added support for Debian 13 Trixie.
    FreeSWITCH v1.11.0 Release · v1.11.0 release notes, platform support · Checked 2026-09-24
  50. 50
    FreeSWITCH v1.11.0 (published 2026-05-07) moved to the PCRE2 regular-expression library, and its release notes warn of breaking changes.
    FreeSWITCH v1.11.0 Release · v1.11.0 release notes, core changes (PCRE2 line) · Checked 2026-09-24
  51. 51
    FreeSWITCH v1.11.0 removed roughly thirty legacy modules, including mod_python, mod_rayo, mod_khomp, mod_gsmopen, mod_skypopen, mod_portaudio and mod_yaml.
    FreeSWITCH v1.11.0 Release · v1.11.0 release notes, removed modules list · Checked 2026-09-24
  52. 52
    FreeSWITCH v1.11.1 added a reloadcert API that reloads TLS certificates in mod_sofia and mod_verto without disconnecting.
    FreeSWITCH v1.11.1 Release · v1.11.1 release notes, enhancements · Checked 2026-09-24
  53. 53
    FreeSWITCH v1.11.2 added an interface allowlist in core and mod_commands and tightened DTLS and STUN validation, including checking a DTLS client certificate against the SDP fingerprint in the server role.
    FreeSWITCH v1.11.2 Release · v1.11.2 release notes, core and mod_commands entries · Checked 2026-09-24
  54. 54
    FreeSWITCH v1.11.3 drops Debian 11 Bullseye and is described as containing critical security fixes and stability improvements.
    FreeSWITCH v1.11.3 Release · v1.11.3 release notes, summary paragraph and enhancements list · Checked 2026-09-24
  55. 55
    Verto WSS takes a single combined PEM file via the secure-combined parameter, typically $${certs_dir}/wss.pem; DTLS-SRTP media uses a separate dtls-srtp.pem.
    Chapter 9: WebRTC with Verto | FreeSWITCH Users Manual · Chapter 9, security and certificates · Checked 2026-09-24
  56. 56
    Verto is a FreeSWITCH signalling protocol of JSON-RPC over WebSocket that lets browser and other WebRTC endpoints register with FreeSWITCH and make and receive calls without a SIP stack.
    Chapter 9: WebRTC with Verto | FreeSWITCH Users Manual · Chapter 9, what is Verto · Checked 2026-09-24
  57. 57
    Verto authenticates users against the existing FreeSWITCH directory XML user database.
    Chapter 9: WebRTC with Verto | FreeSWITCH Users Manual · Chapter 9, authentication and codecs · Checked 2026-09-24
  58. 58
    Verto needs mod_rtc and mod_verto both loaded in modules.conf.xml, with mod_rtc listed first; it is configured in verto.conf.xml.
    Chapter 9: WebRTC with Verto | FreeSWITCH Users Manual · Chapter 9, configuration and modules · Checked 2026-09-24
  59. 59
    The standard Verto profile is named default-v4 and conventionally listens for plain WebSocket on port 8081 and secure WebSocket (WSS) on 8082; a bind-local marked secure="true" makes a WSS binding.
    Chapter 9: WebRTC with Verto | FreeSWITCH Users Manual · Chapter 9, default profile and ports; security and certificates · Checked 2026-09-24
  60. 60
    Verto uses the same core media engine (mod_rtc plus switch_core_media) as SIP over WSS, so both share the same DTLS-SRTP and ICE media path.
    Chapter 9: WebRTC with Verto | FreeSWITCH Users Manual · Chapter 9, relationship to SIP-over-WSS · Checked 2026-09-24

Documents

tier 2 current vendor documentation

Asterisk Versions

Sangoma / Asterisk Project · accessed 2026-09-24

tier 2 current vendor documentation

Chapter 12: The XML Dialplan | FreeSWITCH Users Manual

SignalWire · accessed 2026-09-24

tier 2 current vendor documentation

Chapter 2: Getting Started | FreeSWITCH Users Manual

SignalWire · accessed 2026-09-24

tier 2 current vendor documentation

Chapter 31: CLI and API Command Reference | FreeSWITCH Users Manual

SignalWire · accessed 2026-09-24

tier 2 current vendor documentation

Chapter 5: Module Loading and Management | FreeSWITCH Users Manual

SignalWire · accessed 2026-09-24

tier 2 current vendor documentation

Chapter 7: SIP Profiles with Sofia | FreeSWITCH Users Manual

SignalWire · accessed 2026-09-24

tier 2 current vendor documentation

Chapter 8: Gateways and Trunk Registration | FreeSWITCH Users Manual

SignalWire · accessed 2026-09-24

tier 2 current vendor documentation

Chapter 9: WebRTC with Verto | FreeSWITCH Users Manual

SignalWire · accessed 2026-09-24

tier 2 current vendor documentation

Configuring chan_sip

Sangoma / Asterisk project · accessed 2026-09-24

tier 2 current vendor documentation

Denial-of-Service in SIP PUBLISH Requests via XML Entity Expansion

SignalWire · 2026-05-14 · accessed 2026-09-24

tier 2 current vendor documentation

FreeSWITCH Users Manual

SignalWire · accessed 2026-09-24

tier 2 current vendor documentation

FreeSWITCH v1.11.0 Release

SignalWire · 2026-05-07 · accessed 2026-09-24

tier 2 current vendor documentation

FreeSWITCH v1.11.1 Release

SignalWire · 2026-05-26 · accessed 2026-09-24

tier 2 current vendor documentation

FreeSWITCH v1.11.2 Release

SignalWire · 2026-08-09 · accessed 2026-09-24

tier 2 current vendor documentation

FreeSWITCH v1.11.3 Release

SignalWire · 2026-08-28 · accessed 2026-09-24

tier 2 current vendor documentation

GitHub REST API: signalwire/freeswitch releases (6 most recent)

GitHub / SignalWire · 2026-08-28 · accessed 2026-09-24

tier 2 current vendor documentation

mod_sofia — SIP Endpoint (Sofia) | FreeSWITCH Users Manual

SignalWire · accessed 2026-09-24

tier 2 current vendor documentation

Pre-authentication heap buffer overflow in mod_verto HTTP POST body read

SignalWire · 2026-06-03 · accessed 2026-09-24

tier 2 current vendor documentation

Security overview · signalwire/freeswitch

SignalWire · accessed 2026-09-24

tier 3 vendor-maintained repositories

Asterisk LICENSE file (master branch)

Sangoma (asterisk/asterisk GitHub repository) · accessed 2026-09-24

tier 3 vendor-maintained repositories

FreeSWITCH LICENSE file (master branch)

SignalWire (signalwire/freeswitch GitHub repository) · accessed 2026-09-24

Cite this page

APA

WarmTransfer. (2026, September 24). FreeSWITCH. WarmTransfer. https://warmtransfer.net/knowledge/freeswitch-pbx

BibTeX

@misc{warmtransfer-freeswitch-pbx,
  title  = {FreeSWITCH},
  author = {{WarmTransfer}},
  year   = {2026},
  url    = {https://warmtransfer.net/knowledge/freeswitch-pbx},
  note   = {Verified 2026-09-24}
}