CVE-2026-44323
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
In free5GC prior to 4.2.2, the UDR nudr-dr DELETE handler contains a nil-pointer dereference reachable from a single authenticated request after a preparatory EE-subscription create. It causes a panic and HTTP 500, and the endpoint remains repeatedly panicable.
Risk Assessment
An authenticated attacker can repeatedly trigger panics, leading to denial of service. This may disrupt 5G network operations.
Recommendation
Upgrade free5GC to version 4.2.2, which fixes this vulnerability. Restrict access to UDR endpoints to trusted entities.
Other vulnerabilities in free5GC
See all- CVE-2026-106805Unknown
A resource exhaustion issue exists in Free5GC v4.2.3 during PFCP Session Establishment failure handling. When the SMF does not receive a PFCP Session Establishment Response from the UPF, allocated UE IP address resources are not properly released, and repeated failures can exhaust the UE IP address pool.
- CVE-2026-55068Critical
free5GC in version 4.2.2 and earlier has a vulnerability in the NRF RegisterNFInstance handler that accepts NF Profiles without enforcing UUID format, nfStatus enum values, heartBeatTimer ranges, mandatory profile fields, or nfServices.ipEndPoints address constraints. Invalid profiles are persisted in MongoDB and returned by NFDiscover, allowing an attacker with SBI access to advertise attacker-controlled endpoints and redirect control-plane signaling. This issue is fixed in version 4.2.3.
- CVE-2026-94043Medium
A vulnerability was determined in Free5GC up to 4.2.3 affecting unknown code of file /corefuzzer_deps/free5gc/NFs/amf/internal/gmm/handler.go (Gmm Handler component). Manipulation causes a race condition. The attack can be initiated remotely and the patch is identified as e323b01464355781b8b8d5dd695e05cbc00a62f2.
- CVE-2026-47780Medium
In free5GC 4.2.3 and earlier, HandleCreateEeSubscriptions and HandleQueryeesubscriptions in internal/sbi/api_datarepository.go validate the ueId path value with a regular expression whose final .+ alternative accepts any non-empty string instead of restricting identifiers to supported SUPI and GPSI formats. An actor with network reachability to the UDR SBI can submit a non-3GPP identifier to /nudr-dr/v2/subscription-data/{ueId}/context-data/ee-subscriptions, causing it to pass validation and enter the normal create or query flow. Invalid identifiers can be persisted and retrieved as subscription records.
- CVE-2026-75439High
An issue in Free5GC v.4.2.2 allows a remote attacker to cause a denial of service via the UPF component.
- CVE-2026-55785Low
free5GC before version 1.4.5 has a vulnerability in the AUSF component where cryptographic comparisons (RES* and XRES*, AT_MAC and XMAC) are performed using ordinary equality helpers, and the expected XRES* value is logged at INFO level. This can expose authentication material to parties with access to AUSF logs.
- CVE-2026-55784High
Vulnerability in free5GC (5G core network implementation) version 1.4.4 and earlier. The AUSF component stores authentication state in a global map, allowing an attacker with access to the SBI/N12 interface to send concurrent authentication requests for the same SUPI, overwriting the context and denying authentication to the selected subscriber. No fix available.
- CVE-2026-30073High
A vulnerability in the NssaiAvailabilitySubscriptionCreate component of free5gc v4.0.1 allows an attacker to cause a Denial of Service (DoS) via a crafted POST request.
- CVE-2026-30072High
A NULL pointer dereference in the CDR processing path of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) by supplying a crafted payload.
- CVE-2026-30071High
An issue in the RechargePut function of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via crafted input.
Original NVD description (English source)
free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's UDR nudr-dr DELETE /subscription-data/{ueId}/{servingPlmnId}/ee-subscriptions/{subsId}/amf-subscriptions handler contains a nil-pointer dereference reachable from a single authenticated request, after one preparatory authenticated EE-subscription create. The handler checks _, ok = UESubsData.EeSubscriptionCollection[subsId] and sets a 404 problem-details on the miss path, but then continues to UESubsData.EeSubscriptionCollection[subsId].AmfSubscriptionInfos -- dereferencing the same missing entry instead of returning. Gin recovery converts the panic into HTTP 500, but the endpoint remains repeatedly panicable. This vulnerability is fixed in 4.2.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS