CVE-2026-44317 Details
Description
free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's PCF POST /npcf-policyauthorization/v1/app-sessions handler panics on a single authenticated request whose ascReqData.suppFeat == "1" (enabling traffic-routing feature negotiation) and whose medComponents entries supply an afAppId but NO AfRoutReq. The create path then calls provisioningOfTrafficRoutingInfo(smPolicy, appID, routeReq, ...) with routeReq == nil and dereferences routeReq.RouteToLocs (and other fields) without a nil check, causing runtime error: invalid memory address or nil pointer dereference. Gin recovery converts the panic into HTTP 500. This vulnerability is fixed in 4.2.2.
A denial-of-service vulnerability has been identified in free5GC's PCF component, specifically in the POST /npcf-policyauthorization/v1/app-sessions handler, prior to version 4.2.2. The issue arises when a request is made with the ascReqData.suppFeat set to '1', enabling traffic-routing feature negotiation, while the medComponents entries provide an afAppId but omit the AfRoutReq. This combination leads to a server-side panic due to a nil pointer dereference, as the create path calls provisioningOfTrafficRoutingInfo with a nil routeReq, which is then dereferenced without a nil check. The panic is caught by Gin recovery, which converts it into an HTTP 500 response, creating a per-request denial-of-service condition on the app-session create endpoint.
Users can upgrade to free5GC version 4.2.2 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/free5gc/free5gc/security/advisories/GHSA-wwqh-7jm5-gj7w | CISA-ADP | ExploitVendor Advisory |
| https://github.com/free5gc/free5gc/issues/879 | [email protected] | ExploitIssue Tracking |
| https://github.com/free5gc/free5gc/security/advisories/GHSA-wwqh-7jm5-gj7w | [email protected] | ExploitVendor Advisory |
| https://github.com/free5gc/pcf/commit/508d70b8527a6c8c923179dad450ea01e16b6aeb | [email protected] | Patch |
| https://github.com/free5gc/pcf/pull/65 | [email protected] | Issue TrackingPatch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-476 | NULL Pointer Dereference | [email protected] |
| CWE-754 | Improper Check for Unusual or Exceptional Conditions | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| free5gc free5gc | < 4.2.2 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 28, 2026 | Initial Analysis | [email protected] |
| May 28, 2026 | CVE Modified | CISA-ADP |
| May 27, 2026 | New CVE Received | [email protected] |