CVE-2026-44322 Details
Description
free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's NEF PATCH /3gpp-pfd-management/v1/{afId}/transactions/{transId}/applications/{appId} handler panics with a nil-pointer dereference when the upstream UDR call fails AND the consumer wrapper returns err != nil together with a nil *ProblemDetails. The handler's errPfdData != nil branch builds its own problemDetailsErr correctly, but immediately after it reads problemDetails.Cause (the OTHER value, which is nil in this branch) and panics. Gin recovery converts the panic into HTTP 500, so a single PATCH against this endpoint returns 500 instead of the intended controlled error response whenever UDR access is failing. This vulnerability is fixed in 4.2.2.
A nil-pointer dereference vulnerability has been identified in free5GC's NEF component, specifically in versions through 4.2.1. The issue arises in the PATCH handler for the 3gpp-pfd-management API when the upstream UDR call fails. If the consumer wrapper returns an error along with a nil ProblemDetails, the handler panics by dereferencing the nil value. This panic is caught by Gin's recovery mechanism, which converts it into a generic HTTP 500 response. As a result, the endpoint fails to provide the appropriate error message when UDR access is disrupted, leading to a denial-of-service condition on that specific PATCH operation.
Users can upgrade to free5GC version 4.2.2, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/free5gc/free5gc/security/advisories/GHSA-j59f-x285-69jx | CISA-ADP | ExploitVendor Advisory |
| https://github.com/free5gc/free5gc/issues/925 | [email protected] | ExploitIssue Tracking |
| https://github.com/free5gc/free5gc/security/advisories/GHSA-j59f-x285-69jx | [email protected] | ExploitVendor Advisory |
| https://github.com/free5gc/nef/commit/72a47f3fab4dffbd227f8d92c5f69dca93b610cb | [email protected] | Patch |
| https://github.com/free5gc/nef/pull/22 | [email protected] | Issue TrackingPatch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-476 | NULL Pointer Dereference | [email protected] |
| CWE-754 | Improper Check for Unusual or Exceptional Conditions | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| free5gc free5gc | < 4.2.2 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 28, 2026 | Initial Analysis | [email protected] |
| May 28, 2026 | CVE Modified | CISA-ADP |
| May 27, 2026 | New CVE Received | [email protected] |