CVE-2026-44325 Details
Description
free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's NRF root SBI endpoint POST /oauth2/token contains a parser-level type-confusion bug family. The handler in NFs/nrf/internal/sbi/api_accesstoken.go reflects over models.NrfAccessTokenAccessTokenReq, special-cases only plain string and NrfNfManagementNfType fields, and treats every other field as if it were a single models.PlmnId. The parsed *models.PlmnId is then assigned with reflect.Value.Set() to whichever field name the attacker put in the form body, which panics whenever the destination field's real type is incompatible (slice, different struct, primitive). Gin recovery converts each panic into HTTP 500, but the endpoint remains remotely panicable from a single unauthenticated form-encoded request and is repeatedly triggerable. This vulnerability is fixed in 4.2.2.
A type-confusion vulnerability has been identified in free5GC's Network Repository Function (NRF) implementation, specifically in versions through 4.2.1. The issue resides in the root Service-Based Interface (SBI) endpoint POST /oauth2/token, which is the token-issuance endpoint and intentionally unauthenticated. The vulnerability arises from the endpoint's parser, which mishandles structured form data by treating certain fields as models.PlmnId, leading to runtime panics when the data type does not match the expected format. This flaw can be exploited by sending a single unauthenticated form-encoded request that includes one of the confirmed crashing fields, causing the server to respond with an HTTP 500 error. The vulnerability is repeatable and can be used to degrade the token issuance process by amplifying request failures, generating stack traces, and polluting the server logs.
Users can upgrade to free5GC version 4.2.2, which addresses the type-confusion vulnerability in the NRF OAuth2 token endpoint.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/free5gc/free5gc/security/advisories/GHSA-f8qv-7x5w-qr48 | CISA-ADP | ExploitVendor Advisory |
| https://github.com/free5gc/free5gc/issues/918 | [email protected] | ExploitIssue Tracking |
| https://github.com/free5gc/free5gc/security/advisories/GHSA-f8qv-7x5w-qr48 | [email protected] | ExploitVendor Advisory |
| https://github.com/free5gc/nrf/commit/f7bc77daa7425506af7569f2e61c2a210f5a0423 | [email protected] | Patch |
| https://github.com/free5gc/nrf/pull/83 | [email protected] | Issue TrackingPatch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-20 | Improper Input Validation | [email protected] |
| CWE-755 | Improper Handling of Exceptional Conditions | [email protected] |
| CWE-843 | Access of Resource Using Incompatible Type ('Type Confusion') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| free5gc free5gc | < 4.2.2 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 28, 2026 | Initial Analysis | [email protected] |
| May 27, 2026 | CVE Modified | CISA-ADP |
| May 27, 2026 | New CVE Received | [email protected] |