CWE-754
Allowed-with-ReviewImproper Check for Unusual or Exceptional Conditions
Abstraction: Class · Status: Incomplete
The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.
950 vulnerabilities reference this CWE, most recent first.
GHSA-WP34-JMP7-4Q9F
Vulnerability from github – Published: 2022-05-24 16:46 – Updated: 2022-05-24 16:46A CWE-248 Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause a Denial of Service when sending invalid breakpoint parameters to the controller over Modbus
{
"affected": [],
"aliases": [
"CVE-2018-7855"
],
"database_specific": {
"cwe_ids": [
"CWE-754"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-05-22T21:29:00Z",
"severity": "HIGH"
},
"details": "A CWE-248 Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause a Denial of Service when sending invalid breakpoint parameters to the controller over Modbus",
"id": "GHSA-wp34-jmp7-4q9f",
"modified": "2022-05-24T16:46:14Z",
"published": "2022-05-24T16:46:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-7855"
},
{
"type": "WEB",
"url": "https://www.schneider-electric.com/en/download/document/SEVD-2019-134-11"
},
{
"type": "WEB",
"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0766"
},
{
"type": "WEB",
"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0767"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-WP62-MP77-8HGF
Vulnerability from github – Published: 2022-12-21 06:30 – Updated: 2022-12-21 06:30In sysmmu_map of sysmmu.c, there is a possible EoP due to a precondition check failure. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-238785915References: N/A
{
"affected": [],
"aliases": [
"CVE-2022-20588"
],
"database_specific": {
"cwe_ids": [
"CWE-754"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-12-16T16:15:00Z",
"severity": "MODERATE"
},
"details": "In sysmmu_map of sysmmu.c, there is a possible EoP due to a precondition check failure. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-238785915References: N/A",
"id": "GHSA-wp62-mp77-8hgf",
"modified": "2022-12-21T06:30:30Z",
"published": "2022-12-21T06:30:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-20588"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-WP8H-P32H-FWVC
Vulnerability from github – Published: 2024-02-20 15:31 – Updated: 2024-11-12 21:30The incorrect object was checked for NULL in the built-in profiler, potentially leading to invalid memory access and undefined behavior. Note: This issue only affects the application when the profiler is running. This vulnerability affects Firefox < 123.
{
"affected": [],
"aliases": [
"CVE-2024-1556"
],
"database_specific": {
"cwe_ids": [
"CWE-754"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-20T14:15:09Z",
"severity": "MODERATE"
},
"details": "The incorrect object was checked for NULL in the built-in profiler, potentially leading to invalid memory access and undefined behavior. *Note:* This issue only affects the application when the profiler is running. This vulnerability affects Firefox \u003c 123.",
"id": "GHSA-wp8h-p32h-fwvc",
"modified": "2024-11-12T21:30:49Z",
"published": "2024-02-20T15:31:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1556"
},
{
"type": "WEB",
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1870414"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2024-05"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-WPR6-P2F8-XGCJ
Vulnerability from github – Published: 2022-12-13 18:30 – Updated: 2022-12-15 15:32In loadFromXml of ShortcutPackage.java, there is a possible crash on boot due to an uncaught exception. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-246540168
{
"affected": [],
"aliases": [
"CVE-2022-20500"
],
"database_specific": {
"cwe_ids": [
"CWE-754",
"CWE-755"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-12-13T16:15:00Z",
"severity": "MODERATE"
},
"details": "In loadFromXml of ShortcutPackage.java, there is a possible crash on boot due to an uncaught exception. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-246540168",
"id": "GHSA-wpr6-p2f8-xgcj",
"modified": "2022-12-15T15:32:13Z",
"published": "2022-12-13T18:30:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-20500"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/2022-12-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-WR8J-6CHW-GM6P
Vulnerability from github – Published: 2026-05-08 22:39 – Updated: 2026-06-08 23:47Summary
free5GC's PCF POST /npcf-smpolicycontrol/v1/sm-policies handler (HandleCreateSmPolicyRequest) panics with a nil-pointer dereference when a downstream OpenAPI consumer call (UDR lookup) returns 404 Not Found and the consumer wrapper returns err != nil together with a nil response struct. The handler logs the OpenAPI error and continues executing instead of returning, then dereferences the nil response struct on a subsequent line and panics. Gin recovery converts the panic into HTTP 500, so a single attacker-shaped POST returns 500 instead of a clean 4xx whenever the downstream lookup fails. The PCF process keeps running.
The trigger is a single POST containing input that causes the downstream UDR lookup to fail (e.g. an unknown DNN). In v4.2.1 this endpoint is also reachable WITHOUT an Authorization header because the PCF Npcf_SMPolicyControl route group is mounted without inbound auth middleware (see free5gc/free5gc#844). So in the validation lab the trigger is fully unauthenticated.
Details
Validated against the PCF container in the official Docker compose lab.
- free5GC version: v4.1.0 (originally reported on v4.1.0; same defect present in v4.2.1)
- PCF endpoint: http://10.100.200.9:8000
Vulnerable handler path (paraphrased from the captured stack trace):
[INFO][PCF][SMpolicy] Handle CreateSmPolicy
[ERRO][PCF][Consumer] openapi error: 404, Not Found
[ERRO][PCF][GIN] panic: runtime error: invalid memory address or nil pointer dereference
github.com/free5gc/pcf/internal/sbi/processor.(*Processor).HandleCreateSmPolicyRequest
/go/src/free5gc/NFs/pcf/internal/sbi/processor/smpolicy.go:82 +0x562
github.com/free5gc/pcf/internal/sbi.(*Server).HTTPCreateSMPolicy
/go/src/free5gc/NFs/pcf/internal/sbi/api_smpolicy.go:86 +0x405
The handler's UDR-failure branch logs the OpenAPI error but does not return; the next line dereferences the nil response struct.
Code evidence (paths in free5gc/pcf):
- Panic site:
- NFs/pcf/internal/sbi/processor/smpolicy.go:82
- Route dispatch:
- NFs/pcf/internal/sbi/api_smpolicy.go:86
PoC
Reproduced end-to-end against the running PCF at http://10.100.200.9:8000.
Send a single POST whose dnn is unknown to UDR -- this drives the downstream OpenAPI call to return 404 Not Found, which then triggers the nil-deref panic:
curl -sS -X POST 'http://10.100.200.9:8000/npcf-smpolicycontrol/v1/sm-policies' \
-H 'Content-Type: application/json' \
-d '{
"supi":"imsi-208930000000003",
"pduSessionId":1,
"dnn":"internet-bad",
"sliceInfo":{"sst":1,"sd":"010203"},
"servingNetwork":{"mcc":"208","mnc":"93"},
"accessType":"3GPP_ACCESS",
"notificationUri":"http://smf.free5gc.org:8000/npcf-smpolicycontrol/v1/notify"
}'
Observed response: HTTP 500 Internal Server Error with empty body.
PCF container logs show:
[INFO][PCF][SMpolicy] Handle CreateSmPolicy
[ERRO][PCF][Consumer] openapi error: 404, Not Found
[ERRO][PCF][GIN] panic: runtime error: invalid memory address or nil pointer dereference
...HandleCreateSmPolicyRequest at smpolicy.go:82...
The Gin recovery middleware catches the panic (the captured stack trace runs inside ginRecover.func2.1), so the PCF process keeps serving other requests; the realized impact is per-request HTTP 500 on this endpoint whenever the downstream lookup fails.
Impact
NULL pointer dereference (CWE-476) caused by improper handling of an exceptional branch (CWE-754): the UDR-failure branch logs the OpenAPI error but does not return, then dereferences the nil response struct. The intended behavior is to return a controlled 4xx/5xx ProblemDetails and stop processing.
Gin recovery catches the panic, so the PCF process is NOT killed and other endpoints continue serving. The realized impact is per-request: any unauthenticated POST that drives the downstream UDR lookup to a 404 returns HTTP 500 (with empty body and a stack trace in PCF logs) instead of a controlled error response.
No Confidentiality impact (the response is 500 with empty body). No persistent Integrity impact (the panic happens before any state mutation). Availability impact is limited to per-request degradation. The endpoint remains reachable to unauthenticated attackers via the route-group auth gap separately tracked in free5gc/free5gc#844.
Affected: free5gc v4.2.1 (originally reported against v4.1.0; same defect present).
Upstream issue: https://github.com/free5gc/free5gc/issues/803 Upstream fix: https://github.com/free5gc/pcf/pull/62
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/free5gc/pcf"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.4.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-44316"
],
"database_specific": {
"cwe_ids": [
"CWE-476",
"CWE-754"
],
"github_reviewed": true,
"github_reviewed_at": "2026-05-08T22:39:43Z",
"nvd_published_at": "2026-05-27T17:16:36Z",
"severity": "HIGH"
},
"details": "### Summary\nfree5GC\u0027s PCF `POST /npcf-smpolicycontrol/v1/sm-policies` handler (`HandleCreateSmPolicyRequest`) panics with a nil-pointer dereference when a downstream OpenAPI consumer call (UDR lookup) returns `404 Not Found` and the consumer wrapper returns `err != nil` together with a nil response struct. The handler logs the OpenAPI error and continues executing instead of returning, then dereferences the nil response struct on a subsequent line and panics. Gin recovery converts the panic into `HTTP 500`, so a single attacker-shaped POST returns 500 instead of a clean 4xx whenever the downstream lookup fails. The PCF process keeps running.\n\nThe trigger is a single POST containing input that causes the downstream UDR lookup to fail (e.g. an unknown DNN). In v4.2.1 this endpoint is also reachable WITHOUT an `Authorization` header because the PCF `Npcf_SMPolicyControl` route group is mounted without inbound auth middleware (see free5gc/free5gc#844). So in the validation lab the trigger is fully unauthenticated.\n\n### Details\nValidated against the PCF container in the official Docker compose lab.\n- free5GC version: `v4.1.0` (originally reported on v4.1.0; same defect present in v4.2.1)\n- PCF endpoint: `http://10.100.200.9:8000`\n\nVulnerable handler path (paraphrased from the captured stack trace):\n```\n[INFO][PCF][SMpolicy] Handle CreateSmPolicy\n[ERRO][PCF][Consumer] openapi error: 404, Not Found\n[ERRO][PCF][GIN] panic: runtime error: invalid memory address or nil pointer dereference\n github.com/free5gc/pcf/internal/sbi/processor.(*Processor).HandleCreateSmPolicyRequest\n /go/src/free5gc/NFs/pcf/internal/sbi/processor/smpolicy.go:82 +0x562\n github.com/free5gc/pcf/internal/sbi.(*Server).HTTPCreateSMPolicy\n /go/src/free5gc/NFs/pcf/internal/sbi/api_smpolicy.go:86 +0x405\n```\n\nThe handler\u0027s UDR-failure branch logs the OpenAPI error but does not return; the next line dereferences the nil response struct.\n\nCode evidence (paths in `free5gc/pcf`):\n- Panic site:\n - `NFs/pcf/internal/sbi/processor/smpolicy.go:82`\n- Route dispatch:\n - `NFs/pcf/internal/sbi/api_smpolicy.go:86`\n\n### PoC\nReproduced end-to-end against the running PCF at `http://10.100.200.9:8000`.\n\nSend a single POST whose `dnn` is unknown to UDR -- this drives the downstream OpenAPI call to return `404 Not Found`, which then triggers the nil-deref panic:\n```\ncurl -sS -X POST \u0027http://10.100.200.9:8000/npcf-smpolicycontrol/v1/sm-policies\u0027 \\\n -H \u0027Content-Type: application/json\u0027 \\\n -d \u0027{\n \"supi\":\"imsi-208930000000003\",\n \"pduSessionId\":1,\n \"dnn\":\"internet-bad\",\n \"sliceInfo\":{\"sst\":1,\"sd\":\"010203\"},\n \"servingNetwork\":{\"mcc\":\"208\",\"mnc\":\"93\"},\n \"accessType\":\"3GPP_ACCESS\",\n \"notificationUri\":\"http://smf.free5gc.org:8000/npcf-smpolicycontrol/v1/notify\"\n }\u0027\n```\n\nObserved response: `HTTP 500 Internal Server Error` with empty body.\n\nPCF container logs show:\n```\n[INFO][PCF][SMpolicy] Handle CreateSmPolicy\n[ERRO][PCF][Consumer] openapi error: 404, Not Found\n[ERRO][PCF][GIN] panic: runtime error: invalid memory address or nil pointer dereference\n ...HandleCreateSmPolicyRequest at smpolicy.go:82...\n```\n\nThe Gin recovery middleware catches the panic (the captured stack trace runs inside `ginRecover.func2.1`), so the PCF process keeps serving other requests; the realized impact is per-request `HTTP 500` on this endpoint whenever the downstream lookup fails.\n\n### Impact\nNULL pointer dereference (CWE-476) caused by improper handling of an exceptional branch (CWE-754): the UDR-failure branch logs the OpenAPI error but does not return, then dereferences the nil response struct. The intended behavior is to return a controlled `4xx`/`5xx` `ProblemDetails` and stop processing.\n\nGin recovery catches the panic, so the PCF process is NOT killed and other endpoints continue serving. The realized impact is per-request: any unauthenticated POST that drives the downstream UDR lookup to a `404` returns `HTTP 500` (with empty body and a stack trace in PCF logs) instead of a controlled error response.\n\nNo Confidentiality impact (the response is `500` with empty body). No persistent Integrity impact (the panic happens before any state mutation). Availability impact is limited to per-request degradation. The endpoint remains reachable to unauthenticated attackers via the route-group auth gap separately tracked in free5gc/free5gc#844.\n\nAffected: free5gc v4.2.1 (originally reported against v4.1.0; same defect present).\n\nUpstream issue: https://github.com/free5gc/free5gc/issues/803\nUpstream fix: https://github.com/free5gc/pcf/pull/62",
"id": "GHSA-wr8j-6chw-gm6p",
"modified": "2026-06-08T23:47:04Z",
"published": "2026-05-08T22:39:43Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/free5gc/free5gc/security/advisories/GHSA-wr8j-6chw-gm6p"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44316"
},
{
"type": "WEB",
"url": "https://github.com/free5gc/free5gc/issues/803"
},
{
"type": "WEB",
"url": "https://github.com/free5gc/pcf/pull/62"
},
{
"type": "WEB",
"url": "https://github.com/free5gc/pcf/commit/df535f5524314620715e842baf9723efbeb481a7"
},
{
"type": "PACKAGE",
"url": "https://github.com/free5gc/free5gc"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "free5GC\u0027s PCF npcf-smpolicycontrol POST /sm-policies panics on downstream UDR/OpenAPI 404 via nil pointer dereference"
}
GHSA-WVMR-923C-4GW4
Vulnerability from github – Published: 2025-09-11 15:31 – Updated: 2025-09-11 15:31In Content Management versions 20.4- 25.3 authenticated attackers may exploit a complex cache poisoning technique to download unprotected files from the server if the filenames are known.
{
"affected": [],
"aliases": [
"CVE-2025-8716"
],
"database_specific": {
"cwe_ids": [
"CWE-754"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-11T14:15:42Z",
"severity": "MODERATE"
},
"details": "In Content Management versions 20.4- 25.3 authenticated attackers may exploit a complex cache poisoning technique to download unprotected files from the server if the filenames are known.",
"id": "GHSA-wvmr-923c-4gw4",
"modified": "2025-09-11T15:31:17Z",
"published": "2025-09-11T15:31:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8716"
},
{
"type": "WEB",
"url": "https://support.opentext.com/csm?id=ot_kb_unauthenticated\u0026sysparm_article=KB0847046"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-WWQH-7JM5-GJ7W
Vulnerability from github – Published: 2026-05-08 22:40 – Updated: 2026-06-08 23:47Summary
free5GC's PCF POST /npcf-policyauthorization/v1/app-sessions handler panics on a single authenticated request whose ascReqData.suppFeat == "1" (enabling traffic-routing feature negotiation) and whose medComponents entries supply an afAppId but NO AfRoutReq. The create path then calls provisioningOfTrafficRoutingInfo(smPolicy, appID, routeReq, ...) with routeReq == nil and dereferences routeReq.RouteToLocs (and other fields) without a nil check, causing runtime error: invalid memory address or nil pointer dereference. Gin recovery converts the panic into HTTP 500.
The trigger is a single valid authenticated request -- changing only suppFeat from "0" to "1" flips the same shape of POST from a normal 201 Created into a panic-driven 500.
This endpoint requires a valid npcf-policyauthorization OAuth2 access token (PR:L). The PCF process is not killed (Gin recovers); the realized impact is per-request panic-DoS on the app-session create path.
Details
Validated against the PCF container in the official Docker compose lab.
- Source repo tag: v4.2.1
- PCF endpoint: http://10.100.200.9:8000
- Validation date: 2026-03-12
Vulnerable handler path:
postAppSessCtxProcedure
-> medComponents loop
-> appID := medComp.AfAppId
routeReq := medComp.AfRoutReq // nil when AfRoutReq absent
provisioningOfTrafficRoutingInfo(smPolicy, appID, routeReq, medComp.FStatus)
In provisioningOfTrafficRoutingInfo, routeReq.RouteToLocs, routeReq.UpPathChgSub, and routeReq.AppReloc are dereferenced directly without a nil check. When suppFeat is "0" the traffic-routing branch is not entered and the same input shape returns 201 Created; when suppFeat is "1" the branch is entered and the nil-deref fires.
Code evidence (paths in free5gc/pcf):
- Affected route + dispatch: NFs/pcf/internal/sbi/api_policyauthorization.go
- Create handler path: NFs/pcf/internal/sbi/processor/policyauthorization.go
- Call site that passes nil routeReq into the traffic-routing helper: NFs/pcf/internal/sbi/processor/policyauthorization.go
- Panic site (nil deref of routeReq.* fields): NFs/pcf/internal/sbi/processor/policyauthorization.go:1740
PoC
Reproduced end-to-end against the running PCF at http://10.100.200.9:8000.
- Obtain a valid
npcf-policyauthorizationtoken from NRF:
curl -sS -X POST 'http://10.100.200.3:8000/oauth2/token' \
-H 'Content-Type: application/x-www-form-urlencoded' \
--data 'grant_type=client_credentials&nfType=NEF&nfInstanceId=b84c4f0a-6010-4972-8480-e44e625b9ee4&targetNfType=PCF&scope=npcf-policyauthorization'
- Trigger the panic with a single valid authenticated POST whose
ascReqData.suppFeat == "1",medComponentssuppliesafAppId, andAfRoutReqis absent:
curl -i -X POST 'http://10.100.200.9:8000/npcf-policyauthorization/v1/app-sessions' \
-H 'Content-Type: application/json' \
-H 'Authorization: Bearer <valid_npcf_policyauthorization_jwt>' \
--data '{"ascReqData":{"suppFeat":"1","notifUri":"http://127.0.0.1:9999/appsess","ueIpv4":"10.60.0.3","dnn":"internet","medComponents":{"1":{"medCompN":1,"afAppId":"app1"}}}}'
HTTP/1.1 500 Internal Server Error
- Control comparison -- same request shape but
suppFeat="0"-> normal201 Created:
curl -i -X POST 'http://10.100.200.9:8000/npcf-policyauthorization/v1/app-sessions' \
-H 'Content-Type: application/json' \
-H 'Authorization: Bearer <valid_npcf_policyauthorization_jwt>' \
--data '{"ascReqData":{"suppFeat":"0","notifUri":"http://127.0.0.1:9999/appsess","ueIpv4":"10.60.0.3","dnn":"internet","medComponents":{"1":{"medCompN":1,"afAppId":"app1"}}}}'
HTTP/1.1 201 Created
- PCF container logs show the panic stack landing in
provisioningOfTrafficRoutingInfowithrouteReq = 0x0:
[ERRO][PCF][GIN] panic: runtime error: invalid memory address or nil pointer dereference
github.com/free5gc/pcf/internal/sbi/processor.provisioningOfTrafficRoutingInfo(..., 0x0, ...)
.../policyauthorization.go:1740
github.com/free5gc/pcf/internal/sbi/processor.(*Processor).postAppSessCtxProcedure
.../policyauthorization.go:288
github.com/free5gc/pcf/internal/sbi/processor.(*Processor).HandlePostAppSessionsContext
.../policyauthorization.go:139
github.com/free5gc/pcf/internal/sbi.(*Server).HTTPPostAppSessions
.../api_policyauthorization.go:119
[INFO][PCF][GIN] | 500 | POST | /npcf-policyauthorization/v1/app-sessions |
Impact
NULL pointer dereference (CWE-476) caused by improper handling of an exceptional branch (CWE-754): the create path passes routeReq straight into provisioningOfTrafficRoutingInfo without a nil check, even though medComp.AfRoutReq is optional and is nil for the demonstrated valid input shape. The control experiment with suppFeat="0" proves the request shape itself is otherwise valid.
Gin recovery catches the panic, so the PCF process is NOT killed and other endpoints continue serving. The realized impact is per-request: any authenticated POST against this endpoint with suppFeat="1" and medComponents.*.AfAppId set but AfRoutReq absent returns HTTP 500 with empty body and a stack trace in PCF logs.
Any party that holds (or can obtain) a valid npcf-policyauthorization token can repeatedly drive this code path to sustain a per-request panic-DoS on the app-session create endpoint, with each panic costing more CPU + log writes than the intended controlled response would have.
No Confidentiality impact (the response is 500 with empty body). No persistent Integrity impact (the panic happens before any state mutation). Availability impact is limited to per-request degradation.
Affected: free5gc v4.2.1.
Upstream issue: https://github.com/free5gc/free5gc/issues/879 Upstream fix: https://github.com/free5gc/pcf/pull/65
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/free5gc/pcf"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.4.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-44317"
],
"database_specific": {
"cwe_ids": [
"CWE-476",
"CWE-754"
],
"github_reviewed": true,
"github_reviewed_at": "2026-05-08T22:40:11Z",
"nvd_published_at": "2026-05-27T17:16:36Z",
"severity": "MODERATE"
},
"details": "### Summary\nfree5GC\u0027s PCF `POST /npcf-policyauthorization/v1/app-sessions` handler panics on a single authenticated request whose `ascReqData.suppFeat == \"1\"` (enabling traffic-routing feature negotiation) and whose `medComponents` entries supply an `afAppId` but NO `AfRoutReq`. The create path then calls `provisioningOfTrafficRoutingInfo(smPolicy, appID, routeReq, ...)` with `routeReq == nil` and dereferences `routeReq.RouteToLocs` (and other fields) without a nil check, causing `runtime error: invalid memory address or nil pointer dereference`. Gin recovery converts the panic into `HTTP 500`.\n\nThe trigger is a single valid authenticated request -- changing only `suppFeat` from `\"0\"` to `\"1\"` flips the same shape of POST from a normal `201 Created` into a panic-driven `500`.\n\nThis endpoint requires a valid `npcf-policyauthorization` OAuth2 access token (PR:L). The PCF process is not killed (Gin recovers); the realized impact is per-request panic-DoS on the app-session create path.\n\n### Details\nValidated against the PCF container in the official Docker compose lab.\n- Source repo tag: `v4.2.1`\n- PCF endpoint: `http://10.100.200.9:8000`\n- Validation date: 2026-03-12\n\nVulnerable handler path:\n```\npostAppSessCtxProcedure\n -\u003e medComponents loop\n -\u003e appID := medComp.AfAppId\n routeReq := medComp.AfRoutReq // nil when AfRoutReq absent\n provisioningOfTrafficRoutingInfo(smPolicy, appID, routeReq, medComp.FStatus)\n```\n\nIn `provisioningOfTrafficRoutingInfo`, `routeReq.RouteToLocs`, `routeReq.UpPathChgSub`, and `routeReq.AppReloc` are dereferenced directly without a nil check. When `suppFeat` is `\"0\"` the traffic-routing branch is not entered and the same input shape returns `201 Created`; when `suppFeat` is `\"1\"` the branch is entered and the nil-deref fires.\n\nCode evidence (paths in `free5gc/pcf`):\n- Affected route + dispatch: `NFs/pcf/internal/sbi/api_policyauthorization.go`\n- Create handler path: `NFs/pcf/internal/sbi/processor/policyauthorization.go`\n- Call site that passes nil `routeReq` into the traffic-routing helper: `NFs/pcf/internal/sbi/processor/policyauthorization.go`\n- Panic site (nil deref of `routeReq.*` fields): `NFs/pcf/internal/sbi/processor/policyauthorization.go:1740`\n\n### PoC\nReproduced end-to-end against the running PCF at `http://10.100.200.9:8000`.\n\n1. Obtain a valid `npcf-policyauthorization` token from NRF:\n```\ncurl -sS -X POST \u0027http://10.100.200.3:8000/oauth2/token\u0027 \\\n -H \u0027Content-Type: application/x-www-form-urlencoded\u0027 \\\n --data \u0027grant_type=client_credentials\u0026nfType=NEF\u0026nfInstanceId=b84c4f0a-6010-4972-8480-e44e625b9ee4\u0026targetNfType=PCF\u0026scope=npcf-policyauthorization\u0027\n```\n\n2. Trigger the panic with a single valid authenticated POST whose `ascReqData.suppFeat == \"1\"`, `medComponents` supplies `afAppId`, and `AfRoutReq` is absent:\n```\ncurl -i -X POST \u0027http://10.100.200.9:8000/npcf-policyauthorization/v1/app-sessions\u0027 \\\n -H \u0027Content-Type: application/json\u0027 \\\n -H \u0027Authorization: Bearer \u003cvalid_npcf_policyauthorization_jwt\u003e\u0027 \\\n --data \u0027{\"ascReqData\":{\"suppFeat\":\"1\",\"notifUri\":\"http://127.0.0.1:9999/appsess\",\"ueIpv4\":\"10.60.0.3\",\"dnn\":\"internet\",\"medComponents\":{\"1\":{\"medCompN\":1,\"afAppId\":\"app1\"}}}}\u0027\n```\n```\nHTTP/1.1 500 Internal Server Error\n```\n\n3. Control comparison -- same request shape but `suppFeat=\"0\"` -\u003e normal `201 Created`:\n```\ncurl -i -X POST \u0027http://10.100.200.9:8000/npcf-policyauthorization/v1/app-sessions\u0027 \\\n -H \u0027Content-Type: application/json\u0027 \\\n -H \u0027Authorization: Bearer \u003cvalid_npcf_policyauthorization_jwt\u003e\u0027 \\\n --data \u0027{\"ascReqData\":{\"suppFeat\":\"0\",\"notifUri\":\"http://127.0.0.1:9999/appsess\",\"ueIpv4\":\"10.60.0.3\",\"dnn\":\"internet\",\"medComponents\":{\"1\":{\"medCompN\":1,\"afAppId\":\"app1\"}}}}\u0027\n```\n```\nHTTP/1.1 201 Created\n```\n\n4. PCF container logs show the panic stack landing in `provisioningOfTrafficRoutingInfo` with `routeReq = 0x0`:\n```\n[ERRO][PCF][GIN] panic: runtime error: invalid memory address or nil pointer dereference\n github.com/free5gc/pcf/internal/sbi/processor.provisioningOfTrafficRoutingInfo(..., 0x0, ...)\n .../policyauthorization.go:1740\n github.com/free5gc/pcf/internal/sbi/processor.(*Processor).postAppSessCtxProcedure\n .../policyauthorization.go:288\n github.com/free5gc/pcf/internal/sbi/processor.(*Processor).HandlePostAppSessionsContext\n .../policyauthorization.go:139\n github.com/free5gc/pcf/internal/sbi.(*Server).HTTPPostAppSessions\n .../api_policyauthorization.go:119\n[INFO][PCF][GIN] | 500 | POST | /npcf-policyauthorization/v1/app-sessions |\n```\n\n### Impact\nNULL pointer dereference (CWE-476) caused by improper handling of an exceptional branch (CWE-754): the create path passes `routeReq` straight into `provisioningOfTrafficRoutingInfo` without a nil check, even though `medComp.AfRoutReq` is optional and is nil for the demonstrated valid input shape. The control experiment with `suppFeat=\"0\"` proves the request shape itself is otherwise valid.\n\nGin recovery catches the panic, so the PCF process is NOT killed and other endpoints continue serving. The realized impact is per-request: any authenticated POST against this endpoint with `suppFeat=\"1\"` and `medComponents.*.AfAppId` set but `AfRoutReq` absent returns `HTTP 500` with empty body and a stack trace in PCF logs.\n\nAny party that holds (or can obtain) a valid `npcf-policyauthorization` token can repeatedly drive this code path to sustain a per-request panic-DoS on the app-session create endpoint, with each panic costing more CPU + log writes than the intended controlled response would have.\n\nNo Confidentiality impact (the response is `500` with empty body). No persistent Integrity impact (the panic happens before any state mutation). Availability impact is limited to per-request degradation.\n\nAffected: free5gc v4.2.1.\n\nUpstream issue: https://github.com/free5gc/free5gc/issues/879\nUpstream fix: https://github.com/free5gc/pcf/pull/65",
"id": "GHSA-wwqh-7jm5-gj7w",
"modified": "2026-06-08T23:47:08Z",
"published": "2026-05-08T22:40:11Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/free5gc/free5gc/security/advisories/GHSA-wwqh-7jm5-gj7w"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44317"
},
{
"type": "WEB",
"url": "https://github.com/free5gc/free5gc/issues/879"
},
{
"type": "WEB",
"url": "https://github.com/free5gc/pcf/pull/65"
},
{
"type": "WEB",
"url": "https://github.com/free5gc/pcf/commit/508d70b8527a6c8c923179dad450ea01e16b6aeb"
},
{
"type": "PACKAGE",
"url": "https://github.com/free5gc/free5gc"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "free5GC\u0027s PCF npcf-policyauthorization POST /app-sessions panics on suppFeat=1 with missing AfRoutReq via nil pointer dereference"
}
GHSA-WXPM-2RXR-G39H
Vulnerability from github – Published: 2022-03-11 00:02 – Updated: 2022-03-17 00:02A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause a disruption of communication between the Modicon controller and the engineering software, when an attacker is able to intercept and manipulate specific Modbus response data. Affected Product: EcoStruxure Process Expert (V2021 and prior), EcoStruxure Control Expert (V15.0 SP1 and prior)
{
"affected": [],
"aliases": [
"CVE-2022-24323"
],
"database_specific": {
"cwe_ids": [
"CWE-754"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-03-09T23:15:00Z",
"severity": "MODERATE"
},
"details": "A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause a disruption of communication between the Modicon controller and the engineering software, when an attacker is able to intercept and manipulate specific Modbus response data. Affected Product: EcoStruxure Process Expert (V2021 and prior), EcoStruxure Control Expert (V15.0 SP1 and prior)",
"id": "GHSA-wxpm-2rxr-g39h",
"modified": "2022-03-17T00:02:09Z",
"published": "2022-03-11T00:02:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24323"
},
{
"type": "WEB",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-067-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-WXXP-W379-49QJ
Vulnerability from github – Published: 2023-09-11 09:31 – Updated: 2024-04-04 07:34When checking if the Browsing Context had been discarded in HttpBaseChannel, if the load group was not available then it was assumed to have already been discarded which was not always the case for private channels after the private session had ended. This vulnerability affects Firefox < 117, Firefox ESR < 115.2, and Thunderbird < 115.2.
{
"affected": [],
"aliases": [
"CVE-2023-4583"
],
"database_specific": {
"cwe_ids": [
"CWE-754"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-09-11T09:15:09Z",
"severity": "HIGH"
},
"details": "When checking if the Browsing Context had been discarded in `HttpBaseChannel`, if the load group was not available then it was assumed to have already been discarded which was not always the case for private channels after the private session had ended. This vulnerability affects Firefox \u003c 117, Firefox ESR \u003c 115.2, and Thunderbird \u003c 115.2.",
"id": "GHSA-wxxp-w379-49qj",
"modified": "2024-04-04T07:34:58Z",
"published": "2023-09-11T09:31:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4583"
},
{
"type": "WEB",
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1842030"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2023-34"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2023-36"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2023-38"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-X286-GJF2-C426
Vulnerability from github – Published: 2022-05-24 17:03 – Updated: 2023-02-02 21:34Improper conditions check in multiple Intel? Processors may allow an authenticated user to potentially enable partial escalation of privilege, denial of service and/or information disclosure via local access.
{
"affected": [],
"aliases": [
"CVE-2019-14607"
],
"database_specific": {
"cwe_ids": [
"CWE-754"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-12-16T20:15:00Z",
"severity": "MODERATE"
},
"details": "Improper conditions check in multiple Intel? Processors may allow an authenticated user to potentially enable partial escalation of privilege, denial of service and/or information disclosure via local access.",
"id": "GHSA-x286-gjf2-c426",
"modified": "2023-02-02T21:34:25Z",
"published": "2022-05-24T17:03:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-14607"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20191217-0002"
},
{
"type": "WEB",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00317.html"
},
{
"type": "WEB",
"url": "https://www.synology.com/security/advisory/Synology_SA_19_42"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-3
Strategy: Language Selection
- Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- Choose languages with features such as exception handling that force the programmer to anticipate unusual conditions that may generate exceptions. Custom exceptions may need to be developed to handle unusual business-logic conditions. Be careful not to pass sensitive exceptions back to the user (CWE-209, CWE-248).
Mitigation
Check the results of all functions that return a value and verify that the value is expected.
Mitigation
If using exception handling, catch and throw specific exceptions instead of overly-general exceptions (CWE-396, CWE-397). Catch and handle exceptions as locally as possible so that exceptions do not propagate too far up the call stack (CWE-705). Avoid unchecked or uncaught exceptions where feasible (CWE-248).
Mitigation MIT-39
- Ensure that error messages only contain minimal details that are useful to the intended audience and no one else. The messages need to strike the balance between being too cryptic (which can confuse users) or being too detailed (which may reveal more than intended). The messages should not reveal the methods that were used to determine the error. Attackers can use detailed information to refine or optimize their original attack, thereby increasing their chances of success.
- If errors must be captured in some detail, record them in log messages, but consider what could occur if the log messages can be viewed by attackers. Highly sensitive information such as passwords should never be saved to log files.
- Avoid inconsistent messaging that might accidentally tip off an attacker about internal state, such as whether a user account exists or not.
- Exposing additional information to a potential attacker in the context of an exceptional condition can help the attacker determine what attack vectors are most likely to succeed beyond DoS.
Mitigation MIT-5
Strategy: Input Validation
- Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
- Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
Mitigation MIT-38
If the program must fail, ensure that it fails gracefully (fails closed). There may be a temptation to simply let the program fail poorly in cases such as low memory conditions, but an attacker may be able to assert control before the software has fully exited. Alternately, an uncontrolled failure could cause cascading problems with other downstream components; for example, the program could send a signal to a downstream process so the process immediately knows that a problem has occurred and has a better chance of recovery.
Mitigation
Use system limits, which should help to prevent resource exhaustion. However, the product should still handle low resource conditions since they may still occur.
No CAPEC attack patterns related to this CWE.