CVE-2026-44316
HighSummary
In versions prior to 4.2.2, the PCF POST /npcf-smpolicycontrol/v1/sm-policies handler in free5GC panics due to a nil-pointer dereference when an OpenAPI consumer call returns a 404 error. Instead of returning an error, it continues execution, leading to a panic and returning an HTTP 500 error.
Risk Assessment
An attacker can exploit this vulnerability to trigger a 500 error, potentially leading to unpredictable system behavior and service availability loss. Additionally, the lack of authorization for this endpoint in version 4.2.1 increases the risk of unauthorized access.
Recommendation
It is recommended to upgrade to version 4.2.2 or later to fix this vulnerability. Proper authorization mechanisms should also be implemented for the PCF Npcf_SMPolicyControl endpoint.
Other vulnerabilities in free5GC
See all- CVE-2026-30073Unknown
A vulnerability in the NssaiAvailabilitySubscriptionCreate component of free5gc v4.0.1 allows an attacker to cause a Denial of Service (DoS) via a crafted POST request.
- CVE-2026-30072Unknown
A NULL pointer dereference in the CDR processing path of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) by supplying a crafted payload.
- CVE-2026-30071Unknown
An issue in the RechargePut function of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via crafted input.
- CVE-2026-30070Unknown
An issue in the HandleGetSharedData function of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via crafted input.
- CVE-2026-30069Unknown
A NULL pointer dereference in the UDMC registration handler component of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) by supplying a crafted payload.
- CVE-2026-30068Unknown
Improper input validation in the HandleUpdate function (/sbi/parameter_provision.go) of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via crafted input.
- CVE-2026-30067Unknown
An issue in the complexQueryFilterSubprocess function in the NRF Discovery service of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via crafted input.
- CVE-2026-30064Unknown
Improper input validation in the buildFilter function (processor/processor.go) of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via crafted input.
- CVE-2026-30063Unknown
An issue in the NF Discovery endpoint of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted snssais query.
- CVE-2026-30060Unknown
An issue in free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) when parsing crafted SUCI data during UE registration.
Original NVD description (English source)
free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's PCF POST /npcf-smpolicycontrol/v1/sm-policies handler (HandleCreateSmPolicyRequest) panics with a nil-pointer dereference when a downstream OpenAPI consumer call (UDR lookup) returns 404 Not Found and the consumer wrapper returns err != nil together with a nil response struct. The handler logs the OpenAPI error and continues executing instead of returning, then dereferences the nil response struct on a subsequent line and panics. Gin recovery converts the panic into HTTP 500, so a single attacker-shaped POST returns 500 instead of a clean 4xx whenever the downstream lookup fails. The PCF process keeps running. The trigger is a single POST containing input that causes the downstream UDR lookup to fail (e.g. an unknown DNN). In 4.2.1 this endpoint is also reachable WITHOUT an Authorization header because the PCF Npcf_SMPolicyControl route group is mounted without inbound auth middleware. This vulne