CVE-2026-44328 Details
Description
free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's SMF mounts the UPI management route group without inbound OAuth2 middleware. On top of that, the DELETE /upi/v1/upNodesLinks/{upNodeRef} handler unconditionally dereferences upNode.UPF after the type-guarded async release, even though AN-typed nodes are constructed without a UPF object. As a result, a single unauthenticated DELETE /upi/v1/upNodesLinks/gNB1 request crashes the handler with a nil-pointer panic AND mutates the in-memory user-plane topology before panicking (the UpNodeDelete(upNodeRef) line runs first). This is an unauthenticated, state-mutating panic-DoS sink that an off-path network attacker can trigger by name against any AN entry. This vulnerability is fixed in 4.2.2.
A denial-of-service vulnerability has been identified in free5GC's SMF component, specifically in versions prior to 4.2.2. The issue arises because the SMF mounts the UPI management route group without proper authentication middleware, leaving it exposed to unauthenticated requests. The vulnerability is triggered by the DELETE /upi/v1/upNodesLinks/{upNodeRef} endpoint, which improperly handles AN-typed nodes by dereferencing a nil UPF object, leading to a runtime panic. This flaw not only causes a crash but also disrupts the in-memory user-plane topology, creating a state-mutating denial-of-service condition that can be exploited by an off-path network attacker against any AN entry.
Users can update to free5GC version 4.2.2, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/free5gc/free5gc/issues/905 | CISA-ADP | ExploitIssue Tracking |
| https://github.com/free5gc/free5gc/security/advisories/GHSA-p9mg-74mg-cwwr | CISA-ADP | ExploitVendor Advisory |
| https://github.com/free5gc/free5gc/issues/905 | [email protected] | ExploitIssue Tracking |
| https://github.com/free5gc/free5gc/security/advisories/GHSA-p9mg-74mg-cwwr | [email protected] | ExploitVendor Advisory |
| https://github.com/free5gc/smf/commit/b57bc48081c3d3a2f333d02eb78e4fd31a120deb | [email protected] | Patch |
| https://github.com/free5gc/smf/pull/199 | [email protected] | Issue TrackingPatch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
| CWE-476 | NULL Pointer Dereference | [email protected] |
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| free5gc free5gc | < 4.2.2 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 28, 2026 | Initial Analysis | [email protected] |
| May 27, 2026 | CVE Modified | CISA-ADP |
| May 27, 2026 | New CVE Received | [email protected] |