CVE-2026-44319
HighSummary
In versions prior to 4.2.2, free5GC's NEF terminates the entire process when a stored PFD-subscription notifyUri cannot be reached. An attacker can create a PFD subscription with an attacker-chosen notifyUri and trigger a PFD change, leading to NEF failure.
Risk Assessment
This vulnerability can lead to a complete shutdown of NEF, resulting in the loss of availability of the SBI interface until a restart occurs. It may impact the operation of the 5G network and service availability.
Recommendation
It is recommended to upgrade to version 4.2.2 or later to mitigate this vulnerability. Additionally, monitor and secure PFD subscriptions against unauthorized access.
Other vulnerabilities in free5GC NEF
See all- CVE-2026-44320High
In versions prior to 4.2.2, free5GC's NEF did not require OAuth2/bearer-token authorization for the nnef-callback route group, allowing the use of a forged token to access the SMF-callback handler. The lack of authorization enables attackers to manipulate the actual subscription state.
- CVE-2026-44330Critical
In versions prior to 4.2.2, free5GC's NEF mounts the nnef-pfdmanagement route group without OAuth2/bearer-token authorization. A network attacker can use a forged token to access PFD application data and manage change-notification subscriptions.
- CVE-2026-44327Critical
In versions prior to 4.2.2, free5GC's NEF did not require OAuth2/bearer-token authorization for the nnef-oam route group. A network attacker could access the OAM route without an authorization header, resulting in a 200 OK response.
- CVE-2026-44326Critical
In versions prior to 4.2.2, free5GC's NEF did not require OAuth2/bearer-token authorization for the 3gpp-traffic-influence API. A network attacker could create, read, patch, and delete traffic-influence subscriptions without proper authorization headers.
- CVE-2026-44315Critical
free5GC is an open-source implementation of the 5G core network. Prior to version 4.2.2, free5GC's NEF did not require OAuth2/bearer-token authorization for the PFD management API, allowing attackers to manipulate PFD transaction state using a forged token.
Original NVD description (English source)
free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's NEF terminates the entire process when a stored PFD-subscription notifyUri cannot be reached. In PfdChangeNotifier.FlushNotifications(), the notifier calls NnefPFDmanagementNotify(...) and on any delivery error invokes logger.PFDManageLog.Fatal(err), which is os.Exit(1)-equivalent in Go. An attacker who can create a PFD subscription with an attacker-chosen notifyUri and then trigger a PFD change can deterministically kill NEF on the asynchronous delivery attempt -- the process exits with status 1, dropping NEF's entire SBI surface until restart. This vulnerability is fixed in 4.2.2.