CVE-2026-106805
UnknownSummary
A resource exhaustion issue exists in Free5GC v4.2.3 during PFCP Session Establishment failure handling. When the SMF does not receive a PFCP Session Establishment Response from the UPF, allocated UE IP address resources are not properly released, and repeated failures can exhaust the UE IP address pool.
Risk Assessment
New UEs cannot establish PDU sessions, resulting in denial of service.
Recommendation
Upgrade Free5GC to a fixed version or implement resource monitoring and release mechanisms.
Other vulnerabilities in Free5GC
See all- CVE-2026-55068Critical
free5GC in version 4.2.2 and earlier has a vulnerability in the NRF RegisterNFInstance handler that accepts NF Profiles without enforcing UUID format, nfStatus enum values, heartBeatTimer ranges, mandatory profile fields, or nfServices.ipEndPoints address constraints. Invalid profiles are persisted in MongoDB and returned by NFDiscover, allowing an attacker with SBI access to advertise attacker-controlled endpoints and redirect control-plane signaling. This issue is fixed in version 4.2.3.
- CVE-2026-94043Medium
A vulnerability was determined in Free5GC up to 4.2.3 affecting unknown code of file /corefuzzer_deps/free5gc/NFs/amf/internal/gmm/handler.go (Gmm Handler component). Manipulation causes a race condition. The attack can be initiated remotely and the patch is identified as e323b01464355781b8b8d5dd695e05cbc00a62f2.
- CVE-2026-47780Medium
In free5GC 4.2.3 and earlier, HandleCreateEeSubscriptions and HandleQueryeesubscriptions in internal/sbi/api_datarepository.go validate the ueId path value with a regular expression whose final .+ alternative accepts any non-empty string instead of restricting identifiers to supported SUPI and GPSI formats. An actor with network reachability to the UDR SBI can submit a non-3GPP identifier to /nudr-dr/v2/subscription-data/{ueId}/context-data/ee-subscriptions, causing it to pass validation and enter the normal create or query flow. Invalid identifiers can be persisted and retrieved as subscription records.
- CVE-2026-75439High
An issue in Free5GC v.4.2.2 allows a remote attacker to cause a denial of service via the UPF component.
- CVE-2026-55785Low
free5GC before version 1.4.5 has a vulnerability in the AUSF component where cryptographic comparisons (RES* and XRES*, AT_MAC and XMAC) are performed using ordinary equality helpers, and the expected XRES* value is logged at INFO level. This can expose authentication material to parties with access to AUSF logs.
- CVE-2026-55784High
Vulnerability in free5GC (5G core network implementation) version 1.4.4 and earlier. The AUSF component stores authentication state in a global map, allowing an attacker with access to the SBI/N12 interface to send concurrent authentication requests for the same SUPI, overwriting the context and denying authentication to the selected subscriber. No fix available.
- CVE-2026-30073High
A vulnerability in the NssaiAvailabilitySubscriptionCreate component of free5gc v4.0.1 allows an attacker to cause a Denial of Service (DoS) via a crafted POST request.
- CVE-2026-30072High
A NULL pointer dereference in the CDR processing path of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) by supplying a crafted payload.
- CVE-2026-30071High
An issue in the RechargePut function of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via crafted input.
- CVE-2026-30070High
An issue in the HandleGetSharedData function of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via crafted input.
Original NVD description (English source)
A resource exhaustion issue exists in Free5GC v4.2.3 during PFCP Session Establishment failure handling. When the SMF does not receive a PFCP Session Establishment Response from the UPF, allocated UE IP address resources are not properly released. Repeated failed session establishment attempts can therefore exhaust the UE IP address pool, preventing new UEs from establishing PDU sessions and resulting in denial of service.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS