CVE-2026-41135 Details
Description
free5GC UDR is the Policy Control Function (PCF) for free5GC, an an open-source project for 5th generation (5G) mobile core networks. A memory leak vulnerability in versions prior to 1.4.3 allows any unauthenticated attacker with network access to the PCF SBI interface to cause uncontrolled memory growth by sending repeated HTTP requests to the OAM endpoint. The root cause is a `router.Use()` call inside an HTTP handler that registers a new CORS middleware on every incoming request, permanently growing the Gin router's handler chain. This leads to progressive memory exhaustion and eventual Denial of Service of the PCF, preventing all UEs from obtaining AM and SM policies and blocking 5G session establishment. Version 1.4.3 contains a patch.
A memory leak vulnerability has been identified in free5GC UDR's Policy Control Function (PCF) component, specifically in versions prior to 1.4.3. This vulnerability allows any unauthenticated attacker with network access to the PCF Service-Based Interface (SBI) to cause uncontrolled memory growth by sending repeated HTTP requests to the Operations, Administration, and Maintenance (OAM) endpoint. The issue arises from a CORS middleware being registered on every incoming request, which permanently expands the Gin router's handler chain. As a result, the application experiences progressive memory exhaustion, leading to a denial-of-service condition where all User Equipment (UE) are unable to access Access and Mobility (AM) and Session Management (SM) policies, thereby obstructing 5G session establishment.
Users can upgrade to free5GC version 1.4.3 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/free5gc/free5gc/security/advisories/GHSA-98cp-84m9-q3qp | CISA-ADP | ExploitVendor Advisory |
| https://github.com/free5gc/free5gc/security/advisories/GHSA-98cp-84m9-q3qp | [email protected] | ExploitVendor Advisory |
| https://github.com/free5gc/pcf/commit/599803b1b2eb4611e26d5216481ee142bce71a16 | [email protected] | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| free5gc free5gc | <= 4.2.1 |
CPE
Remediation
| |
| free5gc pcf | < 1.4.3 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 23, 2026 | Initial Analysis | [email protected] |
| Apr 22, 2026 | CVE Modified | CISA-ADP |
| Apr 22, 2026 | New CVE Received | [email protected] |