LoginSign Up
← Back to all sparks
F

FreeSWITCH

MEETINGS
Velocity5.0

Software-defined telecom stack for voice, video and messaging.

signalwire.com/freeswitch ↗

FreeSWITCH is shipping security releases on a cadence it never used to keep.

voipsecurity-hardeningplatform-supportsiplegacy-removal
◆Current state
Three releases in four months after years of near-silence. 1.11.3 is a security and stability cut that drops Debian 11 Bullseye and gates the chat API proto in mod_sofia and mod_verto; 1.11.2 brought an interface allowlist and stricter DTLS/STUN validation; 1.11.1 added hot TLS certificate reloads. The project is treating the telephony attack surface as the main work.
◆Where it's heading
1.11.0 set the terms by deleting roughly thirty legacy modules and migrating to PCRE2, and everything since has been consolidation on the narrower tree: harden what remains, drop old platforms, gate optional protocols behind explicit configuration. Operators still on 1.10 are accumulating a larger migration the longer they wait, which is the practical effect of this cadence.
◆Prediction
Expect the pattern to hold — further point releases on 1.11 weighted to security fixes and platform drops, with new capability arriving only where it serves TLS or SIP hardening.

◆Recent moves

  1. 15d ago

    1.11.3 drops Debian 11 and gates the chat API proto

    Critical security fixes plus timer and SIP MESSAGE corrections, with Debian 11 Bullseye dropped from CI and a new switch to gate the chat API proto in mod_sofia and mod_verto. Consolidation on the narrower tree 1.11.0 left behind, not new ground.

    View source ↗
  2. 1mo ago

    Interface allowlist lands with a broad memory-safety sweep

    An interface allowlist, DTLS client certificate verification and stricter STUN validation, alongside a build system moved off the project's own file host. The security sweep 1.11.3 continues.

    View source ↗
  3. 3mo ago

    Hot TLS certificate reloads and SIP 603 passthrough

    The reloadcert API lets mod_sofia and mod_verto reload TLS certificates without dropping calls — a real operational gain for anyone rotating certs on a live switch, plus SIP 603+ detection and passthrough control.

    View source ↗
  4. 4mo ago

    PCRE2, OpenSSL 3 on Windows, and thirty legacy modules removed

    ⚡ SPARK

    The release that set the terms for everything after it: thirty legacy modules deleted, PCRE2 in place of the old regex engine, and OpenSSL 3 on Windows. Every subsequent release has been hardening the smaller surface it left.

    View source ↗
  5. 2y ago

    ARM64 support arrives, Debian 10 and CentOS dropped

    ARM64 support with Debian 10 and CentOS dropped. Two years before the current run, and already showing the same shape — new platforms in, old platforms out.

    View source ↗
  6. 2y ago

    Coverity fixes and a sofia-sip version bump

    Coverity fixes and a sofia-sip version bump. Maintenance from the quiet period that preceded the current release cadence.

    View source ↗