Most recent entries from all

bdu:2026-13266

2026-09-28T18:44:53.439722+00:00

bdu:2026-13266

fkie_cve-2026-55068

2026-09-28T18:44:53.439756+00:00

free5GC is an open-source implementation of the 5G core network. In 4.2.2 and earlier, the NRF RegisterNFInstance handler at PUT /nnrf-nfm/v1/nf-instances/{nfInstanceID} accepts NF Profiles without enforcing UUID format, nfStatus enum values, heartBeatTimer ranges, mandatory profile fields, or nfServices.ipEndPoints address constraints. The invalid profiles are persisted in the MongoDB NfProfile collection and returned by NFDiscover, allowing an attacker with SBI access to advertise attacker-controlled network-function endpoints and redirect control-plane signaling. This can expose credentials and signaling, alter service discovery integrity, and deny service across network functions that trust the NRF. This issue is fixed in version 4.2.3.

GHSA-x8mj-6p3q-g5pp — free5GC NRF nnrf-nfm lacks NF Profile input validation — enables NF Registration Poisoning with arbitrary service endpo…

2026-09-28T18:44:53.439791+00:00

Affected: Go: github.com/free5gc/free5gc

### Summary

free5GC NRF (Docker image free5gc-fuzz:latest) accepts NF registration requests without validating any field constraints against 3GPP TS 29.510, allowing unauthenticated attackers to inject fake NF profiles with arbitrary service endpoint IP addresses. All 17 constraint violations tested (UUID format, enum values, numeric ranges, mandatory fields, IP endpoint integrity) were accepted with HTTP 200/201. Legitimate NFs discover these fake profiles via NFDiscover and route control-plane traffic to attacker-controlled endpoints, an attacker with SBI network access can intercept control-plane signaling, harvest OAuth2 credentials, and deny service to subscribers.

---

### Details

free5GC NRF's `RegisterNFInstance` handler (PUT `/nnrf-nfm/v1/nf-instances/{nfInstanceID}`) accepts the full NF profile body without field-level validation. The following 3GPP TS 29.510 constraints are violated:

**Format validation**: `nfInstanceId` accepts non-UUID strings (e.g., `"not-a-uuid"`, `"11111111-1111-1111-1111-111111111111"`), violating TS 29.510 §6.1.6.2.2 UUID v4 requirement.

**Enum validation**: `nfStatus` accepts values outside the `{REGISTERED, SUSPENDED, UNDISCOVERABLE}` enum (e.g., `"INVALID_STATUS"`).

**Range validation**: `heartBeatTimer` accepts values outside the valid range [1, 3600] (e.g., `0`, `99999`), violating TS 29.510 §5.2.2.2.

**Mandatory field enforcement**: `nfProfile` is accepted as `null`, violating the required field constraint in §5.2.2.2.

**Servi…