CVE-2026-106805 Details
Description
A resource exhaustion issue exists in Free5GC v4.2.3 during PFCP Session Establishment failure handling. When the SMF does not receive a PFCP Session Establishment Response from the UPF, allocated UE IP address resources are not properly released. Repeated failed session establishment attempts can therefore exhaust the UE IP address pool, preventing new UEs from establishing PDU sessions and resulting in denial of service.
A resource exhaustion vulnerability has been identified in Free5GC version 4.2.3. This issue arises in the Session Management Function (SMF) during the handling of failures in PFCP (Packet Forwarding Control Protocol) Session Establishment. When the SMF does not receive a response from the User Plane Function (UPF), it fails to release the allocated IP address resources for User Equipment (UE). This oversight allows repeated failed session establishment attempts to deplete the available UE IP address pool. Consequently, new UEs are unable to establish PDU (Protocol Data Unit) sessions, leading to a denial-of-service condition.
The vulnerability has been addressed in a recent Free5GC SMF update, which ensures that the SM context and associated UE IP resources are properly released during the PDU Session Establishment Reject process. Users should update to the latest version of Free5GC SMF to mitigate this issue.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 2, 2026CISA-ADP
Assessed Nov 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/free5gc/free5gc/issues/1162 | CISA-ADP | ExploitIssue TrackingTechnical DescriptionVendor |
| https://gist.github.com/hackeryounow/484987c16806c76dd53a8a87355dd0c2 | [email protected] | Technical Description |
| https://github.com/free5gc/free5gc/issues/1162 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/free5gc/smf/pull/236 | [email protected] | Source CodeVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| Free5GC | v4.2.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 5, 2026 | CVE Modified | CISA-ADP |
| Nov 2, 2026 | New CVE Received | [email protected] |