CVE-2026-44323 Details
Description
free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's UDR nudr-dr DELETE /subscription-data/{ueId}/{servingPlmnId}/ee-subscriptions/{subsId}/amf-subscriptions handler contains a nil-pointer dereference reachable from a single authenticated request, after one preparatory authenticated EE-subscription create. The handler checks _, ok = UESubsData.EeSubscriptionCollection[subsId] and sets a 404 problem-details on the miss path, but then continues to UESubsData.EeSubscriptionCollection[subsId].AmfSubscriptionInfos -- dereferencing the same missing entry instead of returning. Gin recovery converts the panic into HTTP 500, but the endpoint remains repeatedly panicable. This vulnerability is fixed in 4.2.2.
A nil-pointer dereference vulnerability has been identified in the free5GC UDR component, specifically in versions through v4.2.1. The issue arises in the 'nudr-dr' DELETE '/subscription-data/{ueId}/{servingPlmnId}/ee-subscriptions/{subsId}/amf-subscriptions' handler. This vulnerability is triggered by an authenticated request that deletes AMF subscriptions for a non-existent 'subsId', after a previous authenticated request has created an EE subscription for the same 'ueId'. The handler improperly handles the missing 'subsId' by attempting to dereference a nil entry, leading to a runtime panic. Although the Gin framework converts this panic into a 500 Internal Server Error response, the endpoint can be repeatedly exploited, causing a denial-of-service condition.
Users can upgrade to free5GC version 4.2.2, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 1, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/free5gc/free5gc/issues/919 | [email protected] | ExploitIssue Tracking |
| https://github.com/free5gc/free5gc/security/advisories/GHSA-4rqf-grm6-vf75 | [email protected] | ExploitVendor Advisory |
| https://github.com/free5gc/udr/commit/8a1d3c63be99d378806d771f086ff32f1867da99 | [email protected] | Patch |
| https://github.com/free5gc/udr/pull/60 | [email protected] | Issue TrackingPatch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-476 | NULL Pointer Dereference | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| free5gc free5gc | < 4.2.2 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 28, 2026 | Initial Analysis | [email protected] |
| May 27, 2026 | New CVE Received | [email protected] |