CVE-2026-55068
CriticalCVSS 9.3Summary
free5GC in version 4.2.2 and earlier has a vulnerability in the NRF RegisterNFInstance handler that accepts NF Profiles without enforcing UUID format, nfStatus enum values, heartBeatTimer ranges, mandatory profile fields, or nfServices.ipEndPoints address constraints. Invalid profiles are persisted in MongoDB and returned by NFDiscover, allowing an attacker with SBI access to advertise attacker-controlled endpoints and redirect control-plane signaling. This issue is fixed in version 4.2.3.
Risk Assessment
An attacker can compromise the integrity of the network discovery service, intercept credentials and signaling, and cause denial of service in the 5G network.
Recommendation
Upgrade free5GC to version 4.2.3 and restrict SBI access to trusted entities.
Original NVD description (English source)
free5GC is an open-source implementation of the 5G core network. In 4.2.2 and earlier, the NRF RegisterNFInstance handler at PUT /nnrf-nfm/v1/nf-instances/{nfInstanceID} accepts NF Profiles without enforcing UUID format, nfStatus enum values, heartBeatTimer ranges, mandatory profile fields, or nfServices.ipEndPoints address constraints. The invalid profiles are persisted in the MongoDB NfProfile collection and returned by NFDiscover, allowing an attacker with SBI access to advertise attacker-controlled network-function endpoints and redirect control-plane signaling. This can expose credentials and signaling, alter service discovery integrity, and deny service across network functions that trust the NRF. This issue is fixed in version 4.2.3.