CVE-2026-44324 Details
Description
free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's UDR nudr-dr DELETE /subscription-data/{ueId}/{servingPlmnId}/ee-subscriptions/{subsId}/amf-subscriptions handler panics on a single authenticated request against a fresh UDR instance when the supplied ueId does not exist in UESubsCollection. The processor checks value, ok := udrSelf.UESubsCollection.Load(ueId) and sets a 404 USER_NOT_FOUND problem-details on the miss path, but execution continues and immediately runs value.(*udr_context.UESubsData) -- a Go type assertion on a nil interface, which panics with interface conversion: interface {} is nil, not *context.UESubsData. Gin recovery converts the panic into HTTP 500, but the endpoint remains repeatedly panicable. This vulnerability is fixed in 4.2.2.
A denial-of-service vulnerability has been identified in the free5GC UDR component, specifically in versions through 4.2.1. The issue arises in the DELETE /subscription-data/{ueId}/{servingPlmnId}/ee-subscriptions/{subsId}/amf-subscriptions endpoint, part of the nudr-dr API. When an authenticated request is made with a ueId that does not exist in the UESubsCollection, the handler panics. This occurs because the missing ueId is acknowledged with a 404 USER_NOT_FOUND response, but the execution continues, leading to a type assertion on a nil value. This panic is converted to an HTTP 500 response, but the endpoint can be repeatedly exploited to cause similar disruptions.
Users can upgrade to free5GC version 4.2.2, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/free5gc/free5gc/issues/920 | CISA-ADP | ExploitIssue Tracking |
| https://github.com/free5gc/free5gc/security/advisories/GHSA-jqfc-gwj5-3w63 | CISA-ADP | ExploitVendor Advisory |
| https://github.com/free5gc/free5gc/issues/920 | [email protected] | ExploitIssue Tracking |
| https://github.com/free5gc/free5gc/security/advisories/GHSA-jqfc-gwj5-3w63 | [email protected] | ExploitVendor Advisory |
| https://github.com/free5gc/udr/commit/8a1d3c63be99d378806d771f086ff32f1867da99 | [email protected] | Patch |
| https://github.com/free5gc/udr/pull/60 | [email protected] | Issue TrackingPatch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-704 | Incorrect Type Conversion or Cast | [email protected] |
| CWE-754 | Improper Check for Unusual or Exceptional Conditions | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| free5gc free5gc | < 4.2.2 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 28, 2026 | Initial Analysis | [email protected] |
| May 28, 2026 | CVE Modified | CISA-ADP |
| May 27, 2026 | New CVE Received | [email protected] |