CVE-2026-44321 Details

A denial-of-service vulnerability has been identified in free5GC's Session Management Function (SMF) prior to version 4.2.2. The issue arises because the SMF exposes a User Plane Interface (UPI) management route group without requiring authentication. This allows attackers to send unauthenticated POST requests to the /upi/v1/upNodesLinks endpoint, injecting overlapping User Plane Function (UPF) IP pool data. The vulnerability is triggered when the injected pool overlaps with an existing one, causing the SMF process to terminate entirely, rather than just the specific request goroutine. This issue disrupts all SMF services until the process is manually restarted.

Users can update to free5GC version 4.2.2, which patches the vulnerability by adding the necessary authentication middleware to the UPI route group, preventing unauthenticated requests from reaching the topology parsing logic that triggers the denial-of-service condition.