CVE-2026-44322
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk50th percentile - higher than 50% of all known CVEs
Summary
In versions prior to 4.2.2, the PATCH handler in free5GC for PFD management can panic due to a nil-pointer dereference when the UDR call fails and the consumer wrapper returns a non-nil error along with a nil *ProblemDetails. This leads to an HTTP 500 error being returned instead of a controlled error response.
Risk Assessment
Organizations using free5GC may experience availability issues when errors occur in communication with UDR, potentially leading to application malfunction and loss of user trust.
Recommendation
It is recommended to upgrade to version 4.2.2 or later to mitigate this vulnerability and ensure proper error handling.
Other vulnerabilities in free5GC
See all- CVE-2026-106805Unknown
A resource exhaustion issue exists in Free5GC v4.2.3 during PFCP Session Establishment failure handling. When the SMF does not receive a PFCP Session Establishment Response from the UPF, allocated UE IP address resources are not properly released, and repeated failures can exhaust the UE IP address pool.
- CVE-2026-55068Critical
free5GC in version 4.2.2 and earlier has a vulnerability in the NRF RegisterNFInstance handler that accepts NF Profiles without enforcing UUID format, nfStatus enum values, heartBeatTimer ranges, mandatory profile fields, or nfServices.ipEndPoints address constraints. Invalid profiles are persisted in MongoDB and returned by NFDiscover, allowing an attacker with SBI access to advertise attacker-controlled endpoints and redirect control-plane signaling. This issue is fixed in version 4.2.3.
- CVE-2026-94043Medium
A vulnerability was determined in Free5GC up to 4.2.3 affecting unknown code of file /corefuzzer_deps/free5gc/NFs/amf/internal/gmm/handler.go (Gmm Handler component). Manipulation causes a race condition. The attack can be initiated remotely and the patch is identified as e323b01464355781b8b8d5dd695e05cbc00a62f2.
- CVE-2026-47780Medium
In free5GC 4.2.3 and earlier, HandleCreateEeSubscriptions and HandleQueryeesubscriptions in internal/sbi/api_datarepository.go validate the ueId path value with a regular expression whose final .+ alternative accepts any non-empty string instead of restricting identifiers to supported SUPI and GPSI formats. An actor with network reachability to the UDR SBI can submit a non-3GPP identifier to /nudr-dr/v2/subscription-data/{ueId}/context-data/ee-subscriptions, causing it to pass validation and enter the normal create or query flow. Invalid identifiers can be persisted and retrieved as subscription records.
- CVE-2026-75439High
An issue in Free5GC v.4.2.2 allows a remote attacker to cause a denial of service via the UPF component.
- CVE-2026-55785Low
free5GC before version 1.4.5 has a vulnerability in the AUSF component where cryptographic comparisons (RES* and XRES*, AT_MAC and XMAC) are performed using ordinary equality helpers, and the expected XRES* value is logged at INFO level. This can expose authentication material to parties with access to AUSF logs.
- CVE-2026-55784High
Vulnerability in free5GC (5G core network implementation) version 1.4.4 and earlier. The AUSF component stores authentication state in a global map, allowing an attacker with access to the SBI/N12 interface to send concurrent authentication requests for the same SUPI, overwriting the context and denying authentication to the selected subscriber. No fix available.
- CVE-2026-30073High
A vulnerability in the NssaiAvailabilitySubscriptionCreate component of free5gc v4.0.1 allows an attacker to cause a Denial of Service (DoS) via a crafted POST request.
- CVE-2026-30072High
A NULL pointer dereference in the CDR processing path of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) by supplying a crafted payload.
- CVE-2026-30071High
An issue in the RechargePut function of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via crafted input.
Original NVD description (English source)
free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's NEF PATCH /3gpp-pfd-management/v1/{afId}/transactions/{transId}/applications/{appId} handler panics with a nil-pointer dereference when the upstream UDR call fails AND the consumer wrapper returns err != nil together with a nil *ProblemDetails. The handler's errPfdData != nil branch builds its own problemDetailsErr correctly, but immediately after it reads problemDetails.Cause (the OTHER value, which is nil in this branch) and panics. Gin recovery converts the panic into HTTP 500, so a single PATCH against this endpoint returns 500 instead of the intended controlled error response whenever UDR access is failing. This vulnerability is fixed in 4.2.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS