CVE-2026-55784
HighCVSS 7.5Summary
Vulnerability in free5GC (5G core network implementation) version 1.4.4 and earlier. The AUSF component stores authentication state in a global map, allowing an attacker with access to the SBI/N12 interface to send concurrent authentication requests for the same SUPI, overwriting the context and denying authentication to the selected subscriber. No fix available.
Risk Assessment
Risk of denial of service for 5G subscribers and potential network disruption.
Recommendation
Monitor and restrict access to the AUSF SBI/N12 interface to trusted networks. Follow free5GC updates for a patch.
Other vulnerabilities in free5GC
See all- CVE-2026-30073Unknown
A vulnerability in the NssaiAvailabilitySubscriptionCreate component of free5gc v4.0.1 allows an attacker to cause a Denial of Service (DoS) via a crafted POST request.
- CVE-2026-30072Unknown
A NULL pointer dereference in the CDR processing path of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) by supplying a crafted payload.
- CVE-2026-30071Unknown
An issue in the RechargePut function of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via crafted input.
- CVE-2026-30070Unknown
An issue in the HandleGetSharedData function of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via crafted input.
- CVE-2026-30069Unknown
A NULL pointer dereference in the UDMC registration handler component of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) by supplying a crafted payload.
- CVE-2026-30068Unknown
Improper input validation in the HandleUpdate function (/sbi/parameter_provision.go) of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via crafted input.
- CVE-2026-30067Unknown
An issue in the complexQueryFilterSubprocess function in the NRF Discovery service of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via crafted input.
- CVE-2026-30064Unknown
Improper input validation in the buildFilter function (processor/processor.go) of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via crafted input.
- CVE-2026-30063Unknown
An issue in the NF Discovery endpoint of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted snssais query.
- CVE-2026-30060Unknown
An issue in free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) when parsing crafted SUCI data during UE registration.
Original NVD description (English source)
free5GC is an open-source implementation of the 5G core network. In version 1.4.4 and earlier, the AUSF component stores per-subscriber authentication state in a global sync.Map named AUSFContext.UePool in internal/context/context.go, keyed only by SUPI. Every request handled by internal/sbi/processor/ue_authentication.go creates an AusfUeContext, and AddAusfUeContextToPool executes ausfContext.UePool.Store(ausfUeContext.Supi, ausfUeContext), unconditionally replacing the active context for that SUPI. An attacker with access to the AUSF SBI/N12 interface can send concurrent POST /nausf-auth/v1/ue-authentications requests for the same target SUPI, causing all attempts to share one logical authentication context URL while K_aut, XRES, and EapID are repeatedly overwritten. A valid EAP-AKA' response for an earlier challenge is then checked against the latest context, causing AT_MAC verification to fail and denying authentication to the selected subscriber while the request flood continues. No fixed version is available as of this review.