CVE-2026-44322
HighSummary
In versions prior to 4.2.2, the PATCH handler in free5GC for PFD management can panic due to a nil-pointer dereference when the UDR call fails and the consumer wrapper returns a non-nil error along with a nil *ProblemDetails. This leads to an HTTP 500 error being returned instead of a controlled error response.
Risk Assessment
Organizations using free5GC may experience availability issues when errors occur in communication with UDR, potentially leading to application malfunction and loss of user trust.
Recommendation
It is recommended to upgrade to version 4.2.2 or later to mitigate this vulnerability and ensure proper error handling.
Other vulnerabilities in free5GC
See all- CVE-2026-30073Unknown
A vulnerability in the NssaiAvailabilitySubscriptionCreate component of free5gc v4.0.1 allows an attacker to cause a Denial of Service (DoS) via a crafted POST request.
- CVE-2026-30072Unknown
A NULL pointer dereference in the CDR processing path of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) by supplying a crafted payload.
- CVE-2026-30071Unknown
An issue in the RechargePut function of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via crafted input.
- CVE-2026-30070Unknown
An issue in the HandleGetSharedData function of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via crafted input.
- CVE-2026-30069Unknown
A NULL pointer dereference in the UDMC registration handler component of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) by supplying a crafted payload.
- CVE-2026-30068Unknown
Improper input validation in the HandleUpdate function (/sbi/parameter_provision.go) of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via crafted input.
- CVE-2026-30067Unknown
An issue in the complexQueryFilterSubprocess function in the NRF Discovery service of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via crafted input.
- CVE-2026-30064Unknown
Improper input validation in the buildFilter function (processor/processor.go) of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via crafted input.
- CVE-2026-30063Unknown
An issue in the NF Discovery endpoint of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted snssais query.
- CVE-2026-30060Unknown
An issue in free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) when parsing crafted SUCI data during UE registration.
Original NVD description (English source)
free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's NEF PATCH /3gpp-pfd-management/v1/{afId}/transactions/{transId}/applications/{appId} handler panics with a nil-pointer dereference when the upstream UDR call fails AND the consumer wrapper returns err != nil together with a nil *ProblemDetails. The handler's errPfdData != nil branch builds its own problemDetailsErr correctly, but immediately after it reads problemDetails.Cause (the OTHER value, which is nil in this branch) and panics. Gin recovery converts the panic into HTTP 500, so a single PATCH against this endpoint returns 500 instead of the intended controlled error response whenever UDR access is failing. This vulnerability is fixed in 4.2.2.