CVE-2026-75439

In free5GC 4.2.3 and earlier, HandleCreateEeSubscriptions and HandleQueryeesubscriptions in internal/sbi/api_datarepository.go validate the ueId path value with a regular expression whose final .+ alternative accepts any non-empty string instead of restricting identifiers to supported SUPI and GPSI formats. An actor with network reachability to the UDR SBI can submit a non-3GPP identifier to /nudr-dr/v2/subscription-data/{ueId}/context-data/ee-subscriptions, causing it to pass validation and enter the normal create or query flow. Invalid identifiers can be persisted and retrieved as subscription records.

In versions prior to 4.2.2, free5GC's SMF mounts the UPI management route group without inbound OAuth2 middleware. As a result, an unauthenticated DELETE /upi/v1/upNodesLinks/gNB1 request crashes the handler with a nil-pointer panic and mutates the in-memory user-plane topology.

In versions prior to 4.2.2, free5GC contains a type confusion bug in the POST /oauth2/token endpoint that can lead to server panic. This bug arises from improper handling of fields in the request, allowing an attacker to trigger server panic through a specially crafted request.

In versions prior to 4.2.2, the PATCH handler in free5GC for PFD management can panic due to a nil-pointer dereference when the UDR call fails and the consumer wrapper returns a non-nil error along with a nil *ProblemDetails. This leads to an HTTP 500 error being returned instead of a controlled error response.

In versions prior to 4.2.2, the PCF POST /npcf-smpolicycontrol/v1/sm-policies handler in free5GC panics due to a nil-pointer dereference when an OpenAPI consumer call returns a 404 error. Instead of returning an error, it continues execution, leading to a panic and returning an HTTP 500 error.

free5GC in version 4.2.2 and earlier has a vulnerability in the NRF RegisterNFInstance handler that accepts NF Profiles without enforcing UUID format, nfStatus enum values, heartBeatTimer ranges, mandatory profile fields, or nfServices.ipEndPoints address constraints. Invalid profiles are persisted in MongoDB and returned by NFDiscover, allowing an attacker with SBI access to advertise attacker-controlled endpoints and redirect control-plane signaling. This issue is fixed in version 4.2.3.

A vulnerability was determined in Free5GC up to 4.2.3 affecting unknown code of file /corefuzzer_deps/free5gc/NFs/amf/internal/gmm/handler.go (Gmm Handler component). Manipulation causes a race condition. The attack can be initiated remotely and the patch is identified as e323b01464355781b8b8d5dd695e05cbc00a62f2.

free5GC before version 1.4.5 has a vulnerability in the AUSF component where cryptographic comparisons (RES* and XRES*, AT_MAC and XMAC) are performed using ordinary equality helpers, and the expected XRES* value is logged at INFO level. This can expose authentication material to parties with access to AUSF logs.

Vulnerability in free5GC (5G core network implementation) version 1.4.4 and earlier. The AUSF component stores authentication state in a global map, allowing an attacker with access to the SBI/N12 interface to send concurrent authentication requests for the same SUPI, overwriting the context and denying authentication to the selected subscriber. No fix available.

A vulnerability in the NssaiAvailabilitySubscriptionCreate component of free5gc v4.0.1 allows an attacker to cause a Denial of Service (DoS) via a crafted POST request.