# FreeSWITCH Canonical: https://warmtransfer.net/knowledge/freeswitch-pbx Last verified: 2026-09-24 FreeSWITCH ships in two editions: open-source FreeSWITCH distributed through GitHub releases, and FreeSWITCH Enterprise, a commercially supported edition from SignalWire that requires a subscription[^19]. The FreeSWITCH Users Manual states that every parameter, value, and default it documents is verified against the FreeSWITCH source and the shipped default configuration[^28]. ## Installation and Configuration Open-source FreeSWITCH is licensed under the Mozilla Public License version 1.1 (MPL 1.1)[^26]. Installing FreeSWITCH from the Debian/Ubuntu package repository requires a SignalWire Personal Access Token, obtained by creating a SignalWire Space and signing in[^33]. Building FreeSWITCH from the GitHub source does not require a SignalWire token[^46]. The FreeSWITCH configuration directory is `/etc/freeswitch` for a distribution-package install and `/usr/local/freeswitch/conf` for a default source build[^7]. The vanilla FreeSWITCH configuration sets a shared `default_password` of 1234 in `vars.xml`, and the manual says to change it before exposing FreeSWITCH to any untrusted network[^10]. The vanilla FreeSWITCH directory defines 20 test users, extensions 1000 through 1019 in the default domain, all sharing the default password[^47]. ## Module Management Which FreeSWITCH modules get compiled is decided at build time by `build/modules.conf.in`, where uncommented lines cause a module to be built as a shared library[^31]. At startup, FreeSWITCH loads the installed modules listed as `load` elements in `autoload_configs/modules.conf.xml`[^32]. FreeSWITCH processes `pre_load_modules.conf.xml` first (typically database drivers such as `mod_pgsql`), then `modules.conf.xml`, then `post_load_modules.conf.xml`[^30]. From `fs_cli`, `load`, `unload`, and `reload` (unload then load) act on a module without restarting FreeSWITCH, and `show modules` lists the loaded modules[^41]. ## SIP Architecture and Gateways `mod_sofia` is the main FreeSWITCH SIP endpoint module and is built on the Sofia-SIP stack[^29]. FreeSWITCH ships 2 SIP profiles: `internal` on port 5060 (via `internal_sip_port`) for registered endpoints, and `external` on port 5080 (via `external_sip_port`) for carrier trunks[^11]. In the shipped profiles, `auth-calls` (digest authentication of INVITEs) is true on the internal profile and false on the external profile[^34]. SIP profile XML files live in `conf/sip_profiles/`, and `sofia.conf.xml` in `autoload_configs` pulls them in with an `X-PRE-PROCESS` include of `../sip_profiles/*.xml`[^36]. The Sofia profile parameters `ext-sip-ip` and `ext-rtp-ip` set the public SIP and RTP addresses FreeSWITCH advertises behind NAT; `sip-ip` and `rtp-ip` set the local bind addresses[^37]. The Sofia profile `context` parameter names the dialplan context for inbound calls on that profile; the internal profile ships with context `public`[^35]. A FreeSWITCH gateway is a named outbound SIP trunk defined in a Sofia profile's `gateways` block that tells the endpoint how to reach a remote provider or peer and can optionally register an account there[^21]. In the vanilla layout, gateway XML files go in `conf/sip_profiles/external/` and are included into the external profile's gateways section by an `X-PRE-PROCESS` include[^23]. The gateway `ping` parameter makes FreeSWITCH send a SIP OPTIONS request to the gateway every N seconds as a keepalive[^24]. To send a call out a gateway, the dialplan `bridge` application uses the endpoint string `sofia/gateway//`, where `` must match the gateway's name attribute exactly[^22]. ## Dialplan Structure and Execution The FreeSWITCH XML dialplan nests elements as `context`, then `extension`, then `condition`, then `action` or `anti-action`[^17]. The vanilla configuration's dialplan in `conf/dialplan/` provides 3 contexts: `default`, `public`, and `features`[^15]. `mod_dialplan_xml` checks a context's extensions in document order and runs the actions of the first extension whose conditions all match; `continue="true"` on an extension lets evaluation go on to the next extension after a match[^16]. A dialplan condition's `break` attribute defaults to `on-false`, so a failed condition stops evaluation of that extension; the other values are `on-true`, `always`, and `never`[^12]. Capture groups in a condition's expression become `$1` through `$N` in later action data, and the full match is available as `${DP_MATCH}`[^13]. Actions marked `inline`, such as `set` or `export`, run immediately while the dialplan is being evaluated instead of being queued[^18]. Unauthenticated inbound calls enter the dialplan context named by the SIP profile's `context` parameter, while calls from authenticated directory users enter the context in that user's `user_context` variable[^14]. The `public` context acts as a security perimeter: it accepts only specific destination numbers and transfers them into the `default` context[^38]. ## WebRTC and Verto Verto is a FreeSWITCH signalling protocol of JSON-RPC over WebSocket that lets browser and other WebRTC endpoints register with FreeSWITCH and make and receive calls without a SIP stack[^56]. Verto needs `mod_rtc` and `mod_verto` both loaded in `modules.conf.xml`, with `mod_rtc` listed first; it is configured in `verto.conf.xml`[^58]. The standard Verto profile is named `default-v4` and conventionally listens for plain WebSocket on port 8081 and secure WebSocket (WSS) on 8082; a `bind-local` marked `secure="true"` makes a WSS binding[^59]. Verto WSS takes a single combined PEM file via the `secure-combined` parameter, typically `$${certs_dir}/wss.pem`; DTLS-SRTP media uses a separate `dtls-srtp.pem`[^55]. Verto authenticates users against the existing FreeSWITCH directory XML user database[^57]. Verto uses the same core media engine (`mod_rtc` plus `switch_core_media`) as SIP over WSS, so both share the same DTLS-SRTP and ICE media path[^60]. ## CLI and Management FreeSWITCH exposes its runtime API through 2 interfaces that share 1 command set: the interactive `fs_cli` console and the Event Socket[^6]. `fs_cli` connects to a running FreeSWITCH over the Event Socket, which listens by default on port 8021 on all interfaces (`::`) with the password `ClueCon`[^20]. The `reloadxml` command reloads all XML configuration from disk without restarting FreeSWITCH[^40]. `sofia status` lists all profiles and gateways, and `sofia status profile reg` shows registrations on that profile, optionally filtered by a contact string[^45]. `sofia global siptrace on|off` turns SIP message trace logging on or off for all profiles from `fs_cli`[^43]. ## Releases and Vulnerabilities The last 1.10.x release, v1.10.12, was published 2024-08-03, and the next release was v1.11.0 on 2026-05-07[^48]. FreeSWITCH v1.11.0 moved to the PCRE2 regular-expression library, and its release notes warn of breaking changes[^50]. FreeSWITCH v1.11.0 removed roughly 30 legacy modules, including `mod_python`, `mod_rayo`, `mod_khomp`, `mod_gsmopen`, `mod_skypopen`, `mod_portaudio`, and `mod_yaml`[^51]. FreeSWITCH v1.11.0 added support for Debian 13 Trixie[^49]. FreeSWITCH v1.11.1 added a `reloadcert` API that reloads TLS certificates in `mod_sofia` and `mod_verto` without disconnecting[^52]. FreeSWITCH v1.11.2 added an interface allowlist in core and `mod_commands` and tightened DTLS and STUN validation, including checking a DTLS client certificate against the SDP fingerprint in the server role[^53]. As of 2026-09-24, the newest open-source FreeSWITCH release is v1.11.3, published 2026-08-28[^25]. FreeSWITCH v1.11.3 drops Debian 11 Bullseye and is described as containing critical security fixes and stability improvements[^54]. CVE-2026-45771 (GHSA-5vjg-pv56-vg4c, CVSS 7.5) lets a SIP PUBLISH with nested XML entities exhaust CPU and memory through `mod_sofia`'s presence handling; it affects 1.10.12 and earlier and is fixed in 1.11.0[^8]. Until upgrading, the advisory for CVE-2026-45771 suggests limiting affected SIP listeners to trusted networks, or setting `manage-presence=false` on untrusted profiles, which also disables presence features such as BLF[^39]. CVE-2026-49841 (GHSA-wfrq-qvg2-f88f, CVSS 9.8) is a heap buffer overflow in `mod_verto`'s HTTP POST body handling that can be triggered before authentication; it affects FreeSWITCH 1.11.0 and earlier and is fixed in 1.11.1[^9]. WarmTransfer's reading of the sources is that a deployment still on FreeSWITCH 1.10.x has no open-source release fixing CVE-2026-45771 or CVE-2026-49841 on its own branch and has to move to 1.11.1 or later to pick up both fixes[^1]. FreeSWITCH vulnerabilities are to be reported privately to `security@signalwire.com` under a responsible-disclosure process[^42]. ## Comparison with Asterisk Asterisk is distributed under the GNU General Public License version 2, and alternative licences can also be negotiated directly with Sangoma US Inc[^5]. Asterisk deprecated its `chan_sip` driver in Asterisk 17 and removed it in Asterisk 21; PJSIP (`res_pjsip`/`chan_pjsip`) is the standard SIP driver[^4]. Asterisk 22 is an LTS series released 2024-10-16, with security fixes only from 2028-10-16 and end of life on 2029-10-16[^2]. The Asterisk versions table lists Asterisk 24 as a pre-release LTS scheduled for 2026-10-15, with EOL on 2031-10-15[^3]. WarmTransfer's reading of the sources is that Asterisk publishes per-series LTS, security-fix-only, and EOL dates, but no comparable published lifecycle table for open-source FreeSWITCH release lines turned up in the sources reviewed[^27]. ## Applicability Applies to: SignalWire FreeSWITCH and Sangoma Asterisk. Deployments: cloud and on-premises. Sources checked 2026-09-24. The newest open-source release covered is v1.11.3, published 2026-08-28[^25]. Debian 11 Bullseye support is dropped in v1.11.3[^54], and Debian 13 Trixie support was added in v1.11.0[^49]. ## What remains uncertain Whether SignalWire backports security fixes to 1.10.x (open source or Enterprise) and any published support lifecycle is not covered by the sources below. Sofia NAT handling, including `ext-rtp-ip` and `ext-sip-ip` value forms (`autonat:`, `stun:`, `host:`) and NAT detection parameters, is not covered by the sources below. The configuration and scope of the v1.11.2 interface allowlist is not covered by the sources below. The FreeSWITCH Enterprise feature set, pricing, and support terms versus open source are not covered by the sources below. Which Sofia profile parameters apply on rescan versus requiring a restart and their effect on live calls are not covered by the sources below. Mapping Sofia gateway and profile concepts to Asterisk PJSIP endpoint, AOR, auth, and registration objects is not covered by the sources below. Gateway state values (`REGED`, `NOREG`, `FAIL_WAIT`, etc.) and `sofia status gateway` or `killgw` usage are not covered by the sources below. Sofia `ws-binding` and `wss-binding` parameters and default ports for SIP over WebSocket are not covered by the sources below. ## Sources [^1]: A deployment still on FreeSWITCH 1.10.x has no open-source release fixing CVE-2026-45771 or CVE-2026-49841 on its own branch and has to move to 1.11.1 or later to pick up both fixes (inferred). Source: [GitHub REST API: signalwire/freeswitch releases (6 most recent)](https://api.github.com/repos/signalwire/freeswitch/releases?per_page=6), Release list: no 1.10.x tag after v1.10.12 (2024-08-03); combined with the patched-version fields of both advisories. Checked 2026-09-24. [^2]: Asterisk 22 is an LTS series released 2024-10-16, with security fixes only from 2028-10-16 and end of life on 2029-10-16. Source: [Asterisk Versions](https://docs.asterisk.org/About-the-Project/Asterisk-Versions/), Release series table, 22.x row. Checked 2026-09-24. [^3]: The Asterisk versions table lists Asterisk 24 as a pre-release LTS scheduled for 2026-10-15, with EOL on 2031-10-15. Source: [Asterisk Versions](https://docs.asterisk.org/About-the-Project/Asterisk-Versions/), Release series table, 24.x row. Checked 2026-09-24. [^4]: Asterisk deprecated its chan_sip driver in Asterisk 17 and removed it in Asterisk 21; PJSIP (res_pjsip/chan_pjsip) is the standard SIP driver. Source: [Configuring chan_sip](https://docs.asterisk.org/Configuration/Channel-Drivers/SIP/Configuring-chan_sip/), Configuring chan_sip page, deprecation/removal notice. Checked 2026-09-24. [^5]: Asterisk is distributed under the GNU General Public License version 2, and alternative licences can also be negotiated directly with Sangoma US Inc. Source: [Asterisk LICENSE file (master branch)](https://raw.githubusercontent.com/asterisk/asterisk/master/LICENSE), LICENSE file, opening paragraphs. Checked 2026-09-24. [^6]: FreeSWITCH exposes its runtime API through two interfaces that share one command set: the interactive fs_cli console and the Event Socket. Source: [Chapter 31: CLI and API Command Reference | FreeSWITCH Users Manual](https://developer.signalwire.com/freeswitch/reference/cli-and-api/), Chapter 31, opening paragraph. Checked 2026-09-24. [^7]: The FreeSWITCH configuration directory is /etc/freeswitch for a distribution-package install and /usr/local/freeswitch/conf for a default source build. Source: [Chapter 2: Getting Started | FreeSWITCH Users Manual](https://developer.signalwire.com/freeswitch/foundations/getting-started/), Chapter 2, default installation paths table. Checked 2026-09-24. [^8]: CVE-2026-45771 (GHSA-5vjg-pv56-vg4c, CVSS 7.5) lets a SIP PUBLISH with nested XML entities exhaust CPU and memory through mod_sofia's presence handling; it affects 1.10.12 and earlier and is fixed in 1.11.0. Source: [Denial-of-Service in SIP PUBLISH Requests via XML Entity Expansion](https://github.com/signalwire/freeswitch/security/advisories/GHSA-5vjg-pv56-vg4c), Advisory header and key details. Checked 2026-09-24. [^9]: CVE-2026-49841 (GHSA-wfrq-qvg2-f88f, CVSS 9.8) is a heap buffer overflow in mod_verto's HTTP POST body handling that can be triggered before authentication; it affects FreeSWITCH 1.11.0 and earlier and is fixed in 1.11.1. Source: [Pre-authentication heap buffer overflow in mod_verto HTTP POST body read](https://github.com/signalwire/freeswitch/security/advisories/GHSA-wfrq-qvg2-f88f), Advisory header (affected/patched versions, severity, CVE) and description. Checked 2026-09-24. [^10]: The vanilla FreeSWITCH configuration sets a shared default_password of 1234 in vars.xml, and the manual says to change it before exposing FreeSWITCH to any untrusted network. Source: [Chapter 2: Getting Started | FreeSWITCH Users Manual](https://developer.signalwire.com/freeswitch/foundations/getting-started/), Chapter 2, default configuration security section. Checked 2026-09-24. [^11]: FreeSWITCH ships two SIP profiles: internal on port 5060 (via internal_sip_port) for registered endpoints, and external on port 5080 (via external_sip_port) for carrier trunks. Source: [Chapter 7: SIP Profiles with Sofia | FreeSWITCH Users Manual](https://developer.signalwire.com/freeswitch/users-and-endpoints/sip-profiles/), Chapter 7, default profiles: internal profile and external profile. Checked 2026-09-24. [^12]: A dialplan condition's break attribute defaults to on-false, so a failed condition stops evaluation of that extension; the other values are on-true, always and never. Source: [Chapter 12: The XML Dialplan | FreeSWITCH Users Manual](https://developer.signalwire.com/freeswitch/dialplan/xml/), Chapter 12, routing logic: condition evaluation. Checked 2026-09-24. [^13]: Capture groups in a condition's expression become $1 through $N in later action data, and the full match is available as ${DP_MATCH}. Source: [Chapter 12: The XML Dialplan | FreeSWITCH Users Manual](https://developer.signalwire.com/freeswitch/dialplan/xml/), Chapter 12, capture and variable substitution. Checked 2026-09-24. [^14]: Unauthenticated inbound calls enter the dialplan context named by the SIP profile's context parameter, while calls from authenticated directory users enter the context in that user's user_context variable. Source: [Chapter 12: The XML Dialplan | FreeSWITCH Users Manual](https://developer.signalwire.com/freeswitch/dialplan/xml/), Chapter 12, context assignment. Checked 2026-09-24. [^15]: The vanilla configuration's dialplan in conf/dialplan/ provides three contexts: default, public and features. Source: [Chapter 12: The XML Dialplan | FreeSWITCH Users Manual](https://developer.signalwire.com/freeswitch/dialplan/xml/), Chapter 12, file organization. Checked 2026-09-24. [^16]: mod_dialplan_xml checks a context's extensions in document order and runs the actions of the first extension whose conditions all match; continue="true" on an extension lets evaluation go on to the next extension after a match. Source: [Chapter 12: The XML Dialplan | FreeSWITCH Users Manual](https://developer.signalwire.com/freeswitch/dialplan/xml/), Chapter 12, routing logic: extension matching. Checked 2026-09-24. [^17]: The FreeSWITCH XML dialplan nests elements as context, then extension, then condition, then action or anti-action. Source: [Chapter 12: The XML Dialplan | FreeSWITCH Users Manual](https://developer.signalwire.com/freeswitch/dialplan/xml/), Chapter 12, core structure. Checked 2026-09-24. [^18]: Actions marked inline, such as set or export, run immediately while the dialplan is being evaluated instead of being queued. Source: [Chapter 12: The XML Dialplan | FreeSWITCH Users Manual](https://developer.signalwire.com/freeswitch/dialplan/xml/), Chapter 12, key applications: inline actions. Checked 2026-09-24. [^19]: FreeSWITCH ships in two editions: open-source FreeSWITCH distributed through GitHub releases, and FreeSWITCH Enterprise, a commercially supported edition from SignalWire that requires a subscription. Source: [FreeSWITCH Users Manual](https://developer.signalwire.com/freeswitch/), Users Manual landing page, editions section. Checked 2026-09-24. [^20]: fs_cli connects to a running FreeSWITCH over the Event Socket, which listens by default on port 8021 on all interfaces (::) with the password ClueCon. Source: [Chapter 31: CLI and API Command Reference | FreeSWITCH Users Manual](https://developer.signalwire.com/freeswitch/reference/cli-and-api/), Chapter 31, connection details. Checked 2026-09-24. [^21]: A FreeSWITCH gateway is a named outbound SIP trunk defined in a Sofia profile's gateways block that tells the endpoint how to reach a remote provider or peer and can optionally register an account there. Source: [Chapter 8: Gateways and Trunk Registration | FreeSWITCH Users Manual](https://developer.signalwire.com/freeswitch/users-and-endpoints/gateways/), Chapter 8, gateway definition (opening section). Checked 2026-09-24. [^22]: To send a call out a gateway, the dialplan bridge application uses the endpoint string sofia/gateway//, where must match the gateway's name attribute exactly. Source: [Chapter 8: Gateways and Trunk Registration | FreeSWITCH Users Manual](https://developer.signalwire.com/freeswitch/users-and-endpoints/gateways/), Chapter 8, outbound call routing. Checked 2026-09-24. [^23]: In the vanilla layout, gateway XML files go in conf/sip_profiles/external/ and are included into the external profile's gateways section by an X-PRE-PROCESS include. Source: [Chapter 8: Gateways and Trunk Registration | FreeSWITCH Users Manual](https://developer.signalwire.com/freeswitch/users-and-endpoints/gateways/), Chapter 8, gateway file location. Checked 2026-09-24. [^24]: The gateway ping parameter makes FreeSWITCH send a SIP OPTIONS request to the gateway every N seconds as a keepalive. Source: [Chapter 8: Gateways and Trunk Registration | FreeSWITCH Users Manual](https://developer.signalwire.com/freeswitch/users-and-endpoints/gateways/), Chapter 8, key parameters table: ping row. Checked 2026-09-24. [^25]: As of 2026-09-24 the newest open-source FreeSWITCH release is v1.11.3, published 2026-08-28. Source: [GitHub REST API: signalwire/freeswitch releases (6 most recent)](https://api.github.com/repos/signalwire/freeswitch/releases?per_page=6), JSON element tag_name v1.11.3, field published_at. Checked 2026-09-24. [^26]: Open-source FreeSWITCH is licensed under the Mozilla Public License version 1.1 (MPL 1.1). Source: [FreeSWITCH LICENSE file (master branch)](https://raw.githubusercontent.com/signalwire/freeswitch/master/LICENSE), LICENSE file header. Checked 2026-09-24. [^27]: Asterisk publishes per-series LTS, security-fix-only and EOL dates, but no comparable published lifecycle table for open-source FreeSWITCH release lines turned up in the sources reviewed (inferred). Source: [Asterisk Versions](https://docs.asterisk.org/About-the-Project/Asterisk-Versions/), Release series table (Asterisk side); FreeSWITCH absence judged from gh-signalwire-freeswitch-security-advisories policy text and the Users Manual landing page. Checked 2026-09-24. [^28]: The FreeSWITCH Users Manual states that every parameter, value and default it documents is verified against the FreeSWITCH source and the shipped default configuration. Source: [FreeSWITCH Users Manual](https://developer.signalwire.com/freeswitch/), Users Manual landing page, introductory text. Checked 2026-09-24. [^29]: mod_sofia is the main FreeSWITCH SIP endpoint module and is built on the Sofia-SIP stack. Source: [mod_sofia — SIP Endpoint (Sofia) | FreeSWITCH Users Manual](https://developer.signalwire.com/freeswitch/module-reference/endpoints/mod_sofia/), Part 9 module reference, mod_sofia entry. Checked 2026-09-24. [^30]: FreeSWITCH processes pre_load_modules.conf.xml first (typically database drivers such as mod_pgsql), then modules.conf.xml, then post_load_modules.conf.xml. Source: [Chapter 5: Module Loading and Management | FreeSWITCH Users Manual](https://developer.signalwire.com/freeswitch/configuration/module-loading/), Chapter 5, module loading process. Checked 2026-09-24. [^31]: Which FreeSWITCH modules get compiled is decided at build time by build/modules.conf.in, where uncommented lines cause a module to be built as a shared library. Source: [Chapter 5: Module Loading and Management | FreeSWITCH Users Manual](https://developer.signalwire.com/freeswitch/configuration/module-loading/), Chapter 5, configuration files and locations: build time. Checked 2026-09-24. [^32]: At startup FreeSWITCH loads the installed modules listed as load elements in autoload_configs/modules.conf.xml. Source: [Chapter 5: Module Loading and Management | FreeSWITCH Users Manual](https://developer.signalwire.com/freeswitch/configuration/module-loading/), Chapter 5, configuration files and locations: runtime. Checked 2026-09-24. [^33]: Installing FreeSWITCH from the Debian/Ubuntu package repository requires a SignalWire Personal Access Token, obtained by creating a SignalWire Space and signing in. Source: [Chapter 2: Getting Started | FreeSWITCH Users Manual](https://developer.signalwire.com/freeswitch/foundations/getting-started/), Chapter 2, package installation section. Checked 2026-09-24. [^34]: In the shipped profiles, auth-calls (digest authentication of INVITEs) is true on the internal profile and false on the external profile. Source: [Chapter 7: SIP Profiles with Sofia | FreeSWITCH Users Manual](https://developer.signalwire.com/freeswitch/users-and-endpoints/sip-profiles/), Chapter 7, critical profile parameters table, auth-calls row. Checked 2026-09-24. [^35]: The Sofia profile context parameter names the dialplan context for inbound calls on that profile; the internal profile ships with context public. Source: [Chapter 7: SIP Profiles with Sofia | FreeSWITCH Users Manual](https://developer.signalwire.com/freeswitch/users-and-endpoints/sip-profiles/), Chapter 7, critical profile parameters table, context row. Checked 2026-09-24. [^36]: SIP profile XML files live in conf/sip_profiles/, and sofia.conf.xml in autoload_configs pulls them in with an X-PRE-PROCESS include of ../sip_profiles/*.xml. Source: [Chapter 7: SIP Profiles with Sofia | FreeSWITCH Users Manual](https://developer.signalwire.com/freeswitch/users-and-endpoints/sip-profiles/), Chapter 7, file organization. Checked 2026-09-24. [^37]: The Sofia profile parameters ext-sip-ip and ext-rtp-ip set the public SIP and RTP addresses FreeSWITCH advertises behind NAT; sip-ip and rtp-ip set the local bind addresses. Source: [Chapter 7: SIP Profiles with Sofia | FreeSWITCH Users Manual](https://developer.signalwire.com/freeswitch/users-and-endpoints/sip-profiles/), Chapter 7, critical profile parameters table. Checked 2026-09-24. [^38]: The public context acts as a security perimeter: it accepts only specific destination numbers and transfers them into the default context. Source: [Chapter 12: The XML Dialplan | FreeSWITCH Users Manual](https://developer.signalwire.com/freeswitch/dialplan/xml/), Chapter 12, public context discussion. Checked 2026-09-24. [^39]: Until they can upgrade, the advisory for CVE-2026-45771 suggests limiting affected SIP listeners to trusted networks, or setting manage-presence=false on untrusted profiles, which also disables presence features such as BLF. Source: [Denial-of-Service in SIP PUBLISH Requests via XML Entity Expansion](https://github.com/signalwire/freeswitch/security/advisories/GHSA-5vjg-pv56-vg4c), Advisory, mitigation section. Checked 2026-09-24. [^40]: The reloadxml command reloads all XML configuration from disk without restarting FreeSWITCH. Source: [Chapter 31: CLI and API Command Reference | FreeSWITCH Users Manual](https://developer.signalwire.com/freeswitch/reference/cli-and-api/), Chapter 31, configuration management: reloadxml. Checked 2026-09-24. [^41]: From fs_cli, load, unload and reload (unload then load) act on a module without restarting FreeSWITCH, and show modules lists the loaded modules. Source: [Chapter 5: Module Loading and Management | FreeSWITCH Users Manual](https://developer.signalwire.com/freeswitch/configuration/module-loading/), Chapter 5, runtime commands table. Checked 2026-09-24. [^42]: FreeSWITCH vulnerabilities are to be reported privately to security@signalwire.com under a responsible-disclosure process. Source: [Security overview · signalwire/freeswitch](https://github.com/signalwire/freeswitch/security), Security policy section. Checked 2026-09-24. [^43]: sofia global siptrace on|off turns SIP message trace logging on or off for all profiles from fs_cli. Source: [Chapter 31: CLI and API Command Reference | FreeSWITCH Users Manual](https://developer.signalwire.com/freeswitch/reference/cli-and-api/), Chapter 31, SIP profile control: sofia global siptrace. Checked 2026-09-24. [^44]: sofia profile rescan re-reads the profile configuration from XML without a full restart, whereas sofia profile restart fully stops and restarts the profile. Source: [Chapter 31: CLI and API Command Reference | FreeSWITCH Users Manual](https://developer.signalwire.com/freeswitch/reference/cli-and-api/), Chapter 31, SIP profile control: sofia profile commands. Checked 2026-09-24. [^45]: sofia status lists all profiles and gateways, and sofia status profile reg shows registrations on that profile, optionally filtered by a contact string. Source: [Chapter 31: CLI and API Command Reference | FreeSWITCH Users Manual](https://developer.signalwire.com/freeswitch/reference/cli-and-api/), Chapter 31, SIP profile control. Checked 2026-09-24. [^46]: Building FreeSWITCH from the GitHub source does not require a SignalWire token. Source: [Chapter 2: Getting Started | FreeSWITCH Users Manual](https://developer.signalwire.com/freeswitch/foundations/getting-started/), Chapter 2, source build section. Checked 2026-09-24. [^47]: The vanilla FreeSWITCH directory defines twenty test users, extensions 1000 through 1019 in the default domain, all sharing the default password. Source: [Chapter 2: Getting Started | FreeSWITCH Users Manual](https://developer.signalwire.com/freeswitch/foundations/getting-started/), Chapter 2, default test extensions section. Checked 2026-09-24. [^48]: The last 1.10.x release, v1.10.12, was published 2024-08-03, and the next release was v1.11.0 on 2026-05-07. Source: [GitHub REST API: signalwire/freeswitch releases (6 most recent)](https://api.github.com/repos/signalwire/freeswitch/releases?per_page=6), JSON elements tag_name v1.10.12 and v1.11.0, field published_at. Checked 2026-09-24. [^49]: FreeSWITCH v1.11.0 added support for Debian 13 Trixie. Source: [FreeSWITCH v1.11.0 Release](https://github.com/signalwire/freeswitch/releases/tag/v1.11.0), v1.11.0 release notes, platform support. Checked 2026-09-24. [^50]: FreeSWITCH v1.11.0 (published 2026-05-07) moved to the PCRE2 regular-expression library, and its release notes warn of breaking changes. Source: [FreeSWITCH v1.11.0 Release](https://github.com/signalwire/freeswitch/releases/tag/v1.11.0), v1.11.0 release notes, core changes (PCRE2 line). Checked 2026-09-24. [^51]: FreeSWITCH v1.11.0 removed roughly thirty legacy modules, including mod_python, mod_rayo, mod_khomp, mod_gsmopen, mod_skypopen, mod_portaudio and mod_yaml. Source: [FreeSWITCH v1.11.0 Release](https://github.com/signalwire/freeswitch/releases/tag/v1.11.0), v1.11.0 release notes, removed modules list. Checked 2026-09-24. [^52]: FreeSWITCH v1.11.1 added a reloadcert API that reloads TLS certificates in mod_sofia and mod_verto without disconnecting. Source: [FreeSWITCH v1.11.1 Release](https://github.com/signalwire/freeswitch/releases/tag/v1.11.1), v1.11.1 release notes, enhancements. Checked 2026-09-24. [^53]: FreeSWITCH v1.11.2 added an interface allowlist in core and mod_commands and tightened DTLS and STUN validation, including checking a DTLS client certificate against the SDP fingerprint in the server role. Source: [FreeSWITCH v1.11.2 Release](https://github.com/signalwire/freeswitch/releases/tag/v1.11.2), v1.11.2 release notes, core and mod_commands entries. Checked 2026-09-24. [^54]: FreeSWITCH v1.11.3 drops Debian 11 Bullseye and is described as containing critical security fixes and stability improvements. Source: [FreeSWITCH v1.11.3 Release](https://github.com/signalwire/freeswitch/releases/tag/v1.11.3), v1.11.3 release notes, summary paragraph and enhancements list. Checked 2026-09-24. [^55]: Verto WSS takes a single combined PEM file via the secure-combined parameter, typically $${certs_dir}/wss.pem; DTLS-SRTP media uses a separate dtls-srtp.pem. Source: [Chapter 9: WebRTC with Verto | FreeSWITCH Users Manual](https://developer.signalwire.com/freeswitch/users-and-endpoints/verto/), Chapter 9, security and certificates. Checked 2026-09-24. [^56]: Verto is a FreeSWITCH signalling protocol of JSON-RPC over WebSocket that lets browser and other WebRTC endpoints register with FreeSWITCH and make and receive calls without a SIP stack. Source: [Chapter 9: WebRTC with Verto | FreeSWITCH Users Manual](https://developer.signalwire.com/freeswitch/users-and-endpoints/verto/), Chapter 9, what is Verto. Checked 2026-09-24. [^57]: Verto authenticates users against the existing FreeSWITCH directory XML user database. Source: [Chapter 9: WebRTC with Verto | FreeSWITCH Users Manual](https://developer.signalwire.com/freeswitch/users-and-endpoints/verto/), Chapter 9, authentication and codecs. Checked 2026-09-24. [^58]: Verto needs mod_rtc and mod_verto both loaded in modules.conf.xml, with mod_rtc listed first; it is configured in verto.conf.xml. Source: [Chapter 9: WebRTC with Verto | FreeSWITCH Users Manual](https://developer.signalwire.com/freeswitch/users-and-endpoints/verto/), Chapter 9, configuration and modules. Checked 2026-09-24. [^59]: The standard Verto profile is named default-v4 and conventionally listens for plain WebSocket on port 8081 and secure WebSocket (WSS) on 8082; a bind-local marked secure="true" makes a WSS binding. Source: [Chapter 9: WebRTC with Verto | FreeSWITCH Users Manual](https://developer.signalwire.com/freeswitch/users-and-endpoints/verto/), Chapter 9, default profile and ports; security and certificates. Checked 2026-09-24. [^60]: Verto uses the same core media engine (mod_rtc plus switch_core_media) as SIP over WSS, so both share the same DTLS-SRTP and ICE media path. Source: [Chapter 9: WebRTC with Verto | FreeSWITCH Users Manual](https://developer.signalwire.com/freeswitch/users-and-endpoints/verto/), Chapter 9, relationship to SIP-over-WSS. Checked 2026-09-24.