CVE-2026-41135
HighSummary
Wersje free5GC przed 1.4.3 zawierają podatność na wyciek pamięci w interfejsie PCF SBI, która pozwala nieautoryzowanym atakującym z dostępem do sieci na powodowanie niekontrolowanego wzrostu pamięci poprzez wysyłanie powtarzających się żądań HTTP do punktu końcowego OAM. Problem wynika z nieprawidłowego zarządzania middleware CORS w obsłudze HTTP.
Risk Assessment
Podatność ta może prowadzić do wyczerpania pamięci i ostatecznie do odmowy usługi (DoS) dla PCF, co uniemożliwia urządzeniom końcowym uzyskanie polityk AM i SM oraz blokuje nawiązywanie sesji 5G. Może to poważnie wpłynąć na dostępność usług sieciowych.
Recommendation
Zaleca się aktualizację do wersji 1.4.3 lub nowszej, która zawiera poprawkę eliminującą tę podatność. Dodatkowo, monitorowanie i ograniczenie liczby żądań do punktu końcowego OAM może pomóc w minimalizacji ryzyka.
Related vulnerabilities
- CVE-2026-78159Critical
The Events Calendar plugin for WordPress in all versions up to and including 6.17.3 is vulnerable to Remote Code Execution via the parse_array function. Insufficient validation of the widget 'classes' map allows a plain-array payload to bypass the is_safe_widget_instance() object check and reach the callable-invocation sink in Element_Classes::parse_array(). This enables unauthenticated attackers to execute code on the server, provided comments are enabled on tribe_events posts and at least one comment containing a crafted wp:legacy-widget block has been submitted.
- CVE-2026-78006Critical
The Events Calendar plugin for WordPress in all versions up to and including 6.17.4 is vulnerable to Remote Code Execution via the is_safe_widget_instance function. Insufficient protection in is_safe_widget_instance can be bypassed because PHP fires magic methods during its pre-parse, combined with enable_rendering_widget_copied() forging a valid wp_hash integrity attribute before unserialize() is reached. This enables unauthenticated attackers to execute code on the server, as the plugin's V2 single-event template runs do_blocks() over buffered comment HTML and WordPress returns a moderation-hash URL allowing an unauthenticated commenter to immediately view their own pending comment.
- CVE-2026-87719Critical
GitLab EE versions from 18.3 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 contain a vulnerability that, under certain conditions, allows an authenticated user with Duo Chat access to obtain Advanced Search instance configurations and sensitive credentials. Exploitation uses a specially crafted GraphQL subscription argument to bypass serialization and perform server object lookup.
- CVE-2026-85706CriticalActively exploited
GitLab CE/EE versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 contain a vulnerability in the repository commits API caused by improper path confinement and missing authentication enforcement. Under certain conditions, an unauthenticated user could read arbitrary files from the GitLab server.
- CVE-2026-90456Critical
An example environment-configuration file for a bundled inventory-management component ships with a fixed, publicly-known administrative password. A deployment that copies this example file into active configuration without running the setup routine that regenerates credentials will expose that component's administrative interface to anyone aware of the default value.
- CVE-2026-53952Critical
GetSimple CMS (v3.4.0a and below) and GetSimple CMS CE (v3.3.22 and below) contain a logic flaw allowing unauthenticated attackers to create a new administrator account. The automated control that deletes admin/setup.php after installation is neutralized by a self-exclusion bug, leaving the setup script accessible. As of publication, no patched versions are available.
- CVE-2026-79395Critical
The WS-Security (wsse:UsernameToken) verification routine in the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier has an improper authentication vulnerability. A remote attacker can bypass authentication and execute privileged ONVIF actions (PTZ control, stream URL retrieval, system reboot) via a crafted SOAP request supplying the admin username with any arbitrary password when the account's stored password is empty.
- CVE-2026-62105Critical
Unauthenticated PHP Object Injection in ThemeREX Addons versions below 2.45.0.
- CVE-2026-62103Critical
Unauthenticated PHP Object Injection in Everest Forms versions 3.6.0 and below.
- CVE-2026-54072Critical
In Authorizer prior to version 2.2.1, the /authorize endpoint accepts any redirect_uri without validating it against AllowedOrigins. With response_type=token or response_type=id_token, the server appends access_token, id_token, and refresh_token as query parameters and issues a 302 redirect to the attacker-supplied URL. An unauthenticated attacker can obtain the client_id from the public /graphql endpoint.
Original NVD description (English source)
free5GC UDR is the Policy Control Function (PCF) for free5GC, an an open-source project for 5th generation (5G) mobile core networks. A memory leak vulnerability in versions prior to 1.4.3 allows any unauthenticated attacker with network access to the PCF SBI interface to cause uncontrolled memory growth by sending repeated HTTP requests to the OAM endpoint. The root cause is a `router.Use()` call inside an HTTP handler that registers a new CORS middleware on every incoming request, permanently growing the Gin router's handler chain. This leads to progressive memory exhaustion and eventual Denial of Service of the PCF, preventing all UEs from obtaining AM and SM policies and blocking 5G session establishment. Version 1.4.3 contains a patch.