Vulnerability-Lookup

CVE-2026-44316 (GCVE-0-2026-44316)

Vulnerability from cvelistv5 – Published: 2026-05-27 15:52 – Updated: 2026-05-27 17:54

Title

free5GC: PCF npcf-smpolicycontrol POST /sm-policies panics on downstream UDR/OpenAPI 404 via nil pointer dereference

Summary

free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's PCF POST /npcf-smpolicycontrol/v1/sm-policies handler (HandleCreateSmPolicyRequest) panics with a nil-pointer dereference when a downstream OpenAPI consumer call (UDR lookup) returns 404 Not Found and the consumer wrapper returns err != nil together with a nil response struct. The handler logs the OpenAPI error and continues executing instead of returning, then dereferences the nil response struct on a subsequent line and panics. Gin recovery converts the panic into HTTP 500, so a single attacker-shaped POST returns 500 instead of a clean 4xx whenever the downstream lookup fails. The PCF process keeps running. The trigger is a single POST containing input that causes the downstream UDR lookup to fail (e.g. an unknown DNN). In 4.2.1 this endpoint is also reachable WITHOUT an Authorization header because the PCF Npcf_SMPolicyControl route group is mounted without inbound auth middleware. This vulnerability is fixed in 4.2.2.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-27 17:54 UTC

CWE

CWE-476 - NULL Pointer Dereference
CWE-754 - Improper Check for Unusual or Exceptional Conditions

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7652 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/free5gc/free5gc/security/advis…	x_refsource_CONFIRM
https://github.com/free5gc/free5gc/issues/803	x_refsource_MISC
https://github.com/free5gc/pcf/pull/62	x_refsource_MISC
https://github.com/free5gc/pcf/commit/df535f55243…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
free5gc	free5gc	Affected: < 4.2.2	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-44316",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-27T17:54:26.642585Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-27T17:54:45.817Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/free5gc/free5gc/issues/803"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "free5gc",
          "vendor": "free5gc",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.2.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC\u0027s PCF POST /npcf-smpolicycontrol/v1/sm-policies handler (HandleCreateSmPolicyRequest) panics with a nil-pointer dereference when a downstream OpenAPI consumer call (UDR lookup) returns 404 Not Found and the consumer wrapper returns err != nil together with a nil response struct. The handler logs the OpenAPI error and continues executing instead of returning, then dereferences the nil response struct on a subsequent line and panics. Gin recovery converts the panic into HTTP 500, so a single attacker-shaped POST returns 500 instead of a clean 4xx whenever the downstream lookup fails. The PCF process keeps running. The trigger is a single POST containing input that causes the downstream UDR lookup to fail (e.g. an unknown DNN). In 4.2.1 this endpoint is also reachable WITHOUT an Authorization header because the PCF Npcf_SMPolicyControl route group is mounted without inbound auth middleware. This vulnerability is fixed in 4.2.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "CWE-476: NULL Pointer Dereference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-754",
              "description": "CWE-754: Improper Check for Unusual or Exceptional Conditions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-27T15:52:07.224Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/free5gc/free5gc/security/advisories/GHSA-wr8j-6chw-gm6p",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/free5gc/free5gc/security/advisories/GHSA-wr8j-6chw-gm6p"
        },
        {
          "name": "https://github.com/free5gc/free5gc/issues/803",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/free5gc/free5gc/issues/803"
        },
        {
          "name": "https://github.com/free5gc/pcf/pull/62",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/free5gc/pcf/pull/62"
        },
        {
          "name": "https://github.com/free5gc/pcf/commit/df535f5524314620715e842baf9723efbeb481a7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/free5gc/pcf/commit/df535f5524314620715e842baf9723efbeb481a7"
        }
      ],
      "source": {
        "advisory": "GHSA-wr8j-6chw-gm6p",
        "discovery": "UNKNOWN"
      },
      "title": "free5GC: PCF npcf-smpolicycontrol POST /sm-policies panics on downstream UDR/OpenAPI 404 via nil pointer dereference"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-44316",
    "datePublished": "2026-05-27T15:52:07.224Z",
    "dateReserved": "2026-05-05T19:00:06.022Z",
    "dateUpdated": "2026-05-27T17:54:45.817Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-44316",
      "date": "2026-10-18",
      "epss": "0.00655",
      "percentile": "0.50361"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "free5gc",
                "vendor": "free5gc",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 4.2.2"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:free5gc:free5gc:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "EF7EBB95-EB4E-44C5-BF0A-9C99B0A7775F",
                    "versionEndExcluding": "4.2.2",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC\u0027s PCF POST /npcf-smpolicycontrol/v1/sm-policies handler (HandleCreateSmPolicyRequest) panics with a nil-pointer dereference when a downstream OpenAPI consumer call (UDR lookup) returns 404 Not Found and the consumer wrapper returns err != nil together with a nil response struct. The handler logs the OpenAPI error and continues executing instead of returning, then dereferences the nil response struct on a subsequent line and panics. Gin recovery converts the panic into HTTP 500, so a single attacker-shaped POST returns 500 instead of a clean 4xx whenever the downstream lookup fails. The PCF process keeps running. The trigger is a single POST containing input that causes the downstream UDR lookup to fail (e.g. an unknown DNN). In 4.2.1 this endpoint is also reachable WITHOUT an Authorization header because the PCF Npcf_SMPolicyControl route group is mounted without inbound auth middleware. This vulnerability is fixed in 4.2.2."
          },
          {
            "lang": "es",
            "value": "free5GC es una implementaci\u00f3n de c\u00f3digo abierto de la red central 5G. Antes de la versi\u00f3n 4.2.2, el gestor PCF POST /npcf-smpolicycontrol/v1/sm-policies de free5GC (HandleCreateSmPolicyRequest) entra en p\u00e1nico con una desreferencia de puntero nulo cuando una llamada de consumidor OpenAPI descendente (b\u00fasqueda de UDR) devuelve 404 Not Found y el envoltorio del consumidor devuelve err != nil junto con una estructura de respuesta nula. El gestor registra el error OpenAPI y contin\u00faa ejecut\u00e1ndose en lugar de retornar, luego desreferencia la estructura de respuesta nula en una l\u00ednea subsiguiente y entra en p\u00e1nico. La recuperaci\u00f3n de Gin convierte el p\u00e1nico en HTTP 500, por lo que un \u00fanico POST con forma de atacante devuelve 500 en lugar de un 4xx limpio cada vez que la b\u00fasqueda descendente falla. El proceso PCF sigue ejecut\u00e1ndose. El disparador es un \u00fanico POST que contiene una entrada que hace que la b\u00fasqueda de UDR descendente falle (por ejemplo, un DNN desconocido). En la versi\u00f3n 4.2.1, este punto final tambi\u00e9n es accesible SIN un encabezado de autorizaci\u00f3n porque el grupo de rutas PCF Npcf_SMPolicyControl se monta sin middleware de autenticaci\u00f3n de entrada. Esta vulnerabilidad se corrige en la versi\u00f3n 4.2.2."
          }
        ],
        "id": "CVE-2026-44316",
        "lastModified": "2026-10-14T20:10:00.190",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-44316",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-27T17:54:26.642585Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-05-27T17:16:36.570",
        "references": [
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Exploit",
              "Issue Tracking"
            ],
            "url": "https://github.com/free5gc/free5gc/issues/803"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Exploit",
              "Vendor Advisory"
            ],
            "url": "https://github.com/free5gc/free5gc/security/advisories/GHSA-wr8j-6chw-gm6p"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Patch"
            ],
            "url": "https://github.com/free5gc/pcf/commit/df535f5524314620715e842baf9723efbeb481a7"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Issue Tracking",
              "Patch"
            ],
            "url": "https://github.com/free5gc/pcf/pull/62"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "tags": [
              "Exploit",
              "Issue Tracking"
            ],
            "url": "https://github.com/free5gc/free5gc/issues/803"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-476"
              },
              {
                "lang": "en",
                "value": "CWE-754"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2026-06-05T19:11:39+00:00",
      "cve": "CVE-2026-44316",
      "id": "CVE-2026-44316",
      "initial_release_date": "2026-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "free5GC: PCF npcf-smpolicycontrol POST /sm-policies panics on downstream UDR/OpenAPI 404 via nil pointer dereference",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44316.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-44316",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-05-27T17:54:26.642585Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-05-27T17:54:41.727Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/free5gc/free5gc/issues/803"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "free5gc",
              "vendor": "free5gc",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 4.2.2"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC\u0027s PCF POST /npcf-smpolicycontrol/v1/sm-policies handler (HandleCreateSmPolicyRequest) panics with a nil-pointer dereference when a downstream OpenAPI consumer call (UDR lookup) returns 404 Not Found and the consumer wrapper returns err != nil together with a nil response struct. The handler logs the OpenAPI error and continues executing instead of returning, then dereferences the nil response struct on a subsequent line and panics. Gin recovery converts the panic into HTTP 500, so a single attacker-shaped POST returns 500 instead of a clean 4xx whenever the downstream lookup fails. The PCF process keeps running. The trigger is a single POST containing input that causes the downstream UDR lookup to fail (e.g. an unknown DNN). In 4.2.1 this endpoint is also reachable WITHOUT an Authorization header because the PCF Npcf_SMPolicyControl route group is mounted without inbound auth middleware. This vulnerability is fixed in 4.2.2."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-476",
                  "description": "CWE-476: NULL Pointer Dereference",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-754",
                  "description": "CWE-754: Improper Check for Unusual or Exceptional Conditions",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-05-27T15:52:07.224Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/free5gc/free5gc/security/advisories/GHSA-wr8j-6chw-gm6p",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/free5gc/free5gc/security/advisories/GHSA-wr8j-6chw-gm6p"
            },
            {
              "name": "https://github.com/free5gc/free5gc/issues/803",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/free5gc/free5gc/issues/803"
            },
            {
              "name": "https://github.com/free5gc/pcf/pull/62",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/free5gc/pcf/pull/62"
            },
            {
              "name": "https://github.com/free5gc/pcf/commit/df535f5524314620715e842baf9723efbeb481a7",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/free5gc/pcf/commit/df535f5524314620715e842baf9723efbeb481a7"
            }
          ],
          "source": {
            "advisory": "GHSA-wr8j-6chw-gm6p",
            "discovery": "UNKNOWN"
          },
          "title": "free5GC: PCF npcf-smpolicycontrol POST /sm-policies panics on downstream UDR/OpenAPI 404 via nil pointer dereference"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-44316",
        "datePublished": "2026-05-27T15:52:07.224Z",
        "dateReserved": "2026-05-05T19:00:06.022Z",
        "dateUpdated": "2026-05-27T17:54:45.817Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

CNVD-2026-37851

Vulnerability from cnvd - Published: 2026-09-15

Title

free5GC空指针取消引用漏洞（CNVD-2026-37851）

Description

free5GC是一个‌开源的5G核心网项目‌，由Linux基金会托管，主要用来实现3GPP标准里定义的5G核心网络功能。 free5GC存在空指针取消引用漏洞，该漏洞源于PCF POST /npcf-smpolicycontrol/v1/sm-policies处理函数未能正确处理下游OpenAPI消费者返回的404错误与空响应结构体，导致后续继续执行时解引用空指针并崩溃。攻击者可利用该漏洞通过构造单个包含未知DNN等可触发下游UDR查找失败的POST请求，导致服务返回HTTP 500状态码，造成拒绝服务。

Severity

高

Patch Name

free5GC空指针取消引用漏洞（CNVD-2026-37851）的补丁

Patch Description

Formal description

目前厂商已发布升级程序修复该安全问题，详情见厂商官网: https://free5gc.org/

Reference

https://github.com/free5gc/free5gc/security/advisories/GHSA-wr8j-6chw-gm6p

Impacted products

Name
free5GC free5GC <4.2.2

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2026-44316",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2026-44316"
    }
  },
  "description": "free5GC\u662f\u4e00\u4e2a\u200c\u5f00\u6e90\u76845G\u6838\u5fc3\u7f51\u9879\u76ee\u200c\uff0c\u7531Linux\u57fa\u91d1\u4f1a\u6258\u7ba1\uff0c\u4e3b\u8981\u7528\u6765\u5b9e\u73b03GPP\u6807\u51c6\u91cc\u5b9a\u4e49\u76845G\u6838\u5fc3\u7f51\u7edc\u529f\u80fd\u3002\n\nfree5GC\u5b58\u5728\u7a7a\u6307\u9488\u53d6\u6d88\u5f15\u7528\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8ePCF POST /npcf-smpolicycontrol/v1/sm-policies\u5904\u7406\u51fd\u6570\u672a\u80fd\u6b63\u786e\u5904\u7406\u4e0b\u6e38OpenAPI\u6d88\u8d39\u8005\u8fd4\u56de\u7684404\u9519\u8bef\u4e0e\u7a7a\u54cd\u5e94\u7ed3\u6784\u4f53\uff0c\u5bfc\u81f4\u540e\u7eed\u7ee7\u7eed\u6267\u884c\u65f6\u89e3\u5f15\u7528\u7a7a\u6307\u9488\u5e76\u5d29\u6e83\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u901a\u8fc7\u6784\u9020\u5355\u4e2a\u5305\u542b\u672a\u77e5DNN\u7b49\u53ef\u89e6\u53d1\u4e0b\u6e38UDR\u67e5\u627e\u5931\u8d25\u7684POST\u8bf7\u6c42\uff0c\u5bfc\u81f4\u670d\u52a1\u8fd4\u56deHTTP 500\u72b6\u6001\u7801\uff0c\u9020\u6210\u62d2\u7edd\u670d\u52a1\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u7a0b\u5e8f\u4fee\u590d\u8be5\u5b89\u5168\u95ee\u9898\uff0c\u8be6\u60c5\u89c1\u5382\u5546\u5b98\u7f51:\r\nhttps://free5gc.org/",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2026-37851",
  "openTime": "2026-09-15",
  "patchDescription": "free5GC\u662f\u4e00\u4e2a\u200c\u5f00\u6e90\u76845G\u6838\u5fc3\u7f51\u9879\u76ee\u200c\uff0c\u7531Linux\u57fa\u91d1\u4f1a\u6258\u7ba1\uff0c\u4e3b\u8981\u7528\u6765\u5b9e\u73b03GPP\u6807\u51c6\u91cc\u5b9a\u4e49\u76845G\u6838\u5fc3\u7f51\u7edc\u529f\u80fd\u3002\r\n\r\nfree5GC\u5b58\u5728\u7a7a\u6307\u9488\u53d6\u6d88\u5f15\u7528\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8ePCF POST /npcf-smpolicycontrol/v1/sm-policies\u5904\u7406\u51fd\u6570\u672a\u80fd\u6b63\u786e\u5904\u7406\u4e0b\u6e38OpenAPI\u6d88\u8d39\u8005\u8fd4\u56de\u7684404\u9519\u8bef\u4e0e\u7a7a\u54cd\u5e94\u7ed3\u6784\u4f53\uff0c\u5bfc\u81f4\u540e\u7eed\u7ee7\u7eed\u6267\u884c\u65f6\u89e3\u5f15\u7528\u7a7a\u6307\u9488\u5e76\u5d29\u6e83\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u901a\u8fc7\u6784\u9020\u5355\u4e2a\u5305\u542b\u672a\u77e5DNN\u7b49\u53ef\u89e6\u53d1\u4e0b\u6e38UDR\u67e5\u627e\u5931\u8d25\u7684POST\u8bf7\u6c42\uff0c\u5bfc\u81f4\u670d\u52a1\u8fd4\u56deHTTP 500\u72b6\u6001\u7801\uff0c\u9020\u6210\u62d2\u7edd\u670d\u52a1\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "free5GC\u7a7a\u6307\u9488\u53d6\u6d88\u5f15\u7528\u6f0f\u6d1e\uff08CNVD-2026-37851\uff09\u7684\u8865\u4e01",
  "products": {
    "product": "free5GC free5GC \u003c4.2.2"
  },
  "referenceLink": "https://github.com/free5gc/free5gc/security/advisories/GHSA-wr8j-6chw-gm6p",
  "serverity": "\u9ad8",
  "submitTime": "2026-05-28",
  "title": "free5GC\u7a7a\u6307\u9488\u53d6\u6d88\u5f15\u7528\u6f0f\u6d1e\uff08CNVD-2026-37851\uff09"
}

FKIE_CVE-2026-44316

Vulnerability from fkie_nvd - Published: 2026-05-27 17:16 - Updated: 2026-10-14 20:10

Severity

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

References

URL	Tags
security-advisories@github.com	https://github.com/free5gc/free5gc/issues/803	Exploit, Issue Tracking
security-advisories@github.com	https://github.com/free5gc/free5gc/security/advisories/GHSA-wr8j-6chw-gm6p	Exploit, Vendor Advisory
security-advisories@github.com	https://github.com/free5gc/pcf/commit/df535f5524314620715e842baf9723efbeb481a7	Patch
security-advisories@github.com	https://github.com/free5gc/pcf/pull/62	Issue Tracking, Patch
134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/free5gc/free5gc/issues/803	Exploit, Issue Tracking

Impacted products

	Vendor	Product	Version
	free5gc	free5gc	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "free5gc",
          "vendor": "free5gc",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.2.2"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:free5gc:free5gc:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "EF7EBB95-EB4E-44C5-BF0A-9C99B0A7775F",
              "versionEndExcluding": "4.2.2",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC\u0027s PCF POST /npcf-smpolicycontrol/v1/sm-policies handler (HandleCreateSmPolicyRequest) panics with a nil-pointer dereference when a downstream OpenAPI consumer call (UDR lookup) returns 404 Not Found and the consumer wrapper returns err != nil together with a nil response struct. The handler logs the OpenAPI error and continues executing instead of returning, then dereferences the nil response struct on a subsequent line and panics. Gin recovery converts the panic into HTTP 500, so a single attacker-shaped POST returns 500 instead of a clean 4xx whenever the downstream lookup fails. The PCF process keeps running. The trigger is a single POST containing input that causes the downstream UDR lookup to fail (e.g. an unknown DNN). In 4.2.1 this endpoint is also reachable WITHOUT an Authorization header because the PCF Npcf_SMPolicyControl route group is mounted without inbound auth middleware. This vulnerability is fixed in 4.2.2."
    },
    {
      "lang": "es",
      "value": "free5GC es una implementaci\u00f3n de c\u00f3digo abierto de la red central 5G. Antes de la versi\u00f3n 4.2.2, el gestor PCF POST /npcf-smpolicycontrol/v1/sm-policies de free5GC (HandleCreateSmPolicyRequest) entra en p\u00e1nico con una desreferencia de puntero nulo cuando una llamada de consumidor OpenAPI descendente (b\u00fasqueda de UDR) devuelve 404 Not Found y el envoltorio del consumidor devuelve err != nil junto con una estructura de respuesta nula. El gestor registra el error OpenAPI y contin\u00faa ejecut\u00e1ndose en lugar de retornar, luego desreferencia la estructura de respuesta nula en una l\u00ednea subsiguiente y entra en p\u00e1nico. La recuperaci\u00f3n de Gin convierte el p\u00e1nico en HTTP 500, por lo que un \u00fanico POST con forma de atacante devuelve 500 en lugar de un 4xx limpio cada vez que la b\u00fasqueda descendente falla. El proceso PCF sigue ejecut\u00e1ndose. El disparador es un \u00fanico POST que contiene una entrada que hace que la b\u00fasqueda de UDR descendente falle (por ejemplo, un DNN desconocido). En la versi\u00f3n 4.2.1, este punto final tambi\u00e9n es accesible SIN un encabezado de autorizaci\u00f3n porque el grupo de rutas PCF Npcf_SMPolicyControl se monta sin middleware de autenticaci\u00f3n de entrada. Esta vulnerabilidad se corrige en la versi\u00f3n 4.2.2."
    }
  ],
  "id": "CVE-2026-44316",
  "lastModified": "2026-10-14T20:10:00.190",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-44316",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-05-27T17:54:26.642585Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-05-27T17:16:36.570",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Issue Tracking"
      ],
      "url": "https://github.com/free5gc/free5gc/issues/803"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/free5gc/free5gc/security/advisories/GHSA-wr8j-6chw-gm6p"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/free5gc/pcf/commit/df535f5524314620715e842baf9723efbeb481a7"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Issue Tracking",
        "Patch"
      ],
      "url": "https://github.com/free5gc/pcf/pull/62"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Issue Tracking"
      ],
      "url": "https://github.com/free5gc/free5gc/issues/803"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-476"
        },
        {
          "lang": "en",
          "value": "CWE-754"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-WR8J-6CHW-GM6P

Vulnerability from github – Published: 2026-05-08 22:39 – Updated: 2026-06-08 23:47

Summary

free5GC's PCF npcf-smpolicycontrol POST /sm-policies panics on downstream UDR/OpenAPI 404 via nil pointer dereference

Details

Summary

free5GC's PCF POST /npcf-smpolicycontrol/v1/sm-policies handler (HandleCreateSmPolicyRequest) panics with a nil-pointer dereference when a downstream OpenAPI consumer call (UDR lookup) returns 404 Not Found and the consumer wrapper returns err != nil together with a nil response struct. The handler logs the OpenAPI error and continues executing instead of returning, then dereferences the nil response struct on a subsequent line and panics. Gin recovery converts the panic into HTTP 500, so a single attacker-shaped POST returns 500 instead of a clean 4xx whenever the downstream lookup fails. The PCF process keeps running.

The trigger is a single POST containing input that causes the downstream UDR lookup to fail (e.g. an unknown DNN). In v4.2.1 this endpoint is also reachable WITHOUT an Authorization header because the PCF Npcf_SMPolicyControl route group is mounted without inbound auth middleware (see free5gc/free5gc#844). So in the validation lab the trigger is fully unauthenticated.

Details

Validated against the PCF container in the official Docker compose lab. - free5GC version: v4.1.0 (originally reported on v4.1.0; same defect present in v4.2.1) - PCF endpoint: http://10.100.200.9:8000

Vulnerable handler path (paraphrased from the captured stack trace):

[INFO][PCF][SMpolicy] Handle CreateSmPolicy
[ERRO][PCF][Consumer] openapi error: 404, Not Found
[ERRO][PCF][GIN] panic: runtime error: invalid memory address or nil pointer dereference
  github.com/free5gc/pcf/internal/sbi/processor.(*Processor).HandleCreateSmPolicyRequest
      /go/src/free5gc/NFs/pcf/internal/sbi/processor/smpolicy.go:82 +0x562
  github.com/free5gc/pcf/internal/sbi.(*Server).HTTPCreateSMPolicy
      /go/src/free5gc/NFs/pcf/internal/sbi/api_smpolicy.go:86 +0x405

The handler's UDR-failure branch logs the OpenAPI error but does not return; the next line dereferences the nil response struct.

Code evidence (paths in free5gc/pcf): - Panic site: - NFs/pcf/internal/sbi/processor/smpolicy.go:82 - Route dispatch: - NFs/pcf/internal/sbi/api_smpolicy.go:86

PoC

Reproduced end-to-end against the running PCF at http://10.100.200.9:8000.

Send a single POST whose dnn is unknown to UDR -- this drives the downstream OpenAPI call to return 404 Not Found, which then triggers the nil-deref panic:

curl -sS -X POST 'http://10.100.200.9:8000/npcf-smpolicycontrol/v1/sm-policies' \
  -H 'Content-Type: application/json' \
  -d '{
    "supi":"imsi-208930000000003",
    "pduSessionId":1,
    "dnn":"internet-bad",
    "sliceInfo":{"sst":1,"sd":"010203"},
    "servingNetwork":{"mcc":"208","mnc":"93"},
    "accessType":"3GPP_ACCESS",
    "notificationUri":"http://smf.free5gc.org:8000/npcf-smpolicycontrol/v1/notify"
  }'

Observed response: HTTP 500 Internal Server Error with empty body.

PCF container logs show:

[INFO][PCF][SMpolicy] Handle CreateSmPolicy
[ERRO][PCF][Consumer] openapi error: 404, Not Found
[ERRO][PCF][GIN] panic: runtime error: invalid memory address or nil pointer dereference
  ...HandleCreateSmPolicyRequest at smpolicy.go:82...

The Gin recovery middleware catches the panic (the captured stack trace runs inside ginRecover.func2.1), so the PCF process keeps serving other requests; the realized impact is per-request HTTP 500 on this endpoint whenever the downstream lookup fails.

Impact

NULL pointer dereference (CWE-476) caused by improper handling of an exceptional branch (CWE-754): the UDR-failure branch logs the OpenAPI error but does not return, then dereferences the nil response struct. The intended behavior is to return a controlled 4xx/5xx ProblemDetails and stop processing.

Gin recovery catches the panic, so the PCF process is NOT killed and other endpoints continue serving. The realized impact is per-request: any unauthenticated POST that drives the downstream UDR lookup to a 404 returns HTTP 500 (with empty body and a stack trace in PCF logs) instead of a controlled error response.

No Confidentiality impact (the response is 500 with empty body). No persistent Integrity impact (the panic happens before any state mutation). Availability impact is limited to per-request degradation. The endpoint remains reachable to unauthenticated attackers via the route-group auth gap separately tracked in free5gc/free5gc#844.

Affected: free5gc v4.2.1 (originally reported against v4.1.0; same defect present).

Upstream issue: https://github.com/free5gc/free5gc/issues/803 Upstream fix: https://github.com/free5gc/pcf/pull/62

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/free5gc/pcf"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.4.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-44316"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-476",
      "CWE-754"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-08T22:39:43Z",
    "nvd_published_at": "2026-05-27T17:16:36Z",
    "severity": "HIGH"
  },
  "details": "### Summary\nfree5GC\u0027s PCF `POST /npcf-smpolicycontrol/v1/sm-policies` handler (`HandleCreateSmPolicyRequest`) panics with a nil-pointer dereference when a downstream OpenAPI consumer call (UDR lookup) returns `404 Not Found` and the consumer wrapper returns `err != nil` together with a nil response struct. The handler logs the OpenAPI error and continues executing instead of returning, then dereferences the nil response struct on a subsequent line and panics. Gin recovery converts the panic into `HTTP 500`, so a single attacker-shaped POST returns 500 instead of a clean 4xx whenever the downstream lookup fails. The PCF process keeps running.\n\nThe trigger is a single POST containing input that causes the downstream UDR lookup to fail (e.g. an unknown DNN). In v4.2.1 this endpoint is also reachable WITHOUT an `Authorization` header because the PCF `Npcf_SMPolicyControl` route group is mounted without inbound auth middleware (see free5gc/free5gc#844). So in the validation lab the trigger is fully unauthenticated.\n\n### Details\nValidated against the PCF container in the official Docker compose lab.\n- free5GC version: `v4.1.0` (originally reported on v4.1.0; same defect present in v4.2.1)\n- PCF endpoint: `http://10.100.200.9:8000`\n\nVulnerable handler path (paraphrased from the captured stack trace):\n```\n[INFO][PCF][SMpolicy] Handle CreateSmPolicy\n[ERRO][PCF][Consumer] openapi error: 404, Not Found\n[ERRO][PCF][GIN] panic: runtime error: invalid memory address or nil pointer dereference\n  github.com/free5gc/pcf/internal/sbi/processor.(*Processor).HandleCreateSmPolicyRequest\n      /go/src/free5gc/NFs/pcf/internal/sbi/processor/smpolicy.go:82 +0x562\n  github.com/free5gc/pcf/internal/sbi.(*Server).HTTPCreateSMPolicy\n      /go/src/free5gc/NFs/pcf/internal/sbi/api_smpolicy.go:86 +0x405\n```\n\nThe handler\u0027s UDR-failure branch logs the OpenAPI error but does not return; the next line dereferences the nil response struct.\n\nCode evidence (paths in `free5gc/pcf`):\n- Panic site:\n  - `NFs/pcf/internal/sbi/processor/smpolicy.go:82`\n- Route dispatch:\n  - `NFs/pcf/internal/sbi/api_smpolicy.go:86`\n\n### PoC\nReproduced end-to-end against the running PCF at `http://10.100.200.9:8000`.\n\nSend a single POST whose `dnn` is unknown to UDR -- this drives the downstream OpenAPI call to return `404 Not Found`, which then triggers the nil-deref panic:\n```\ncurl -sS -X POST \u0027http://10.100.200.9:8000/npcf-smpolicycontrol/v1/sm-policies\u0027 \\\n  -H \u0027Content-Type: application/json\u0027 \\\n  -d \u0027{\n    \"supi\":\"imsi-208930000000003\",\n    \"pduSessionId\":1,\n    \"dnn\":\"internet-bad\",\n    \"sliceInfo\":{\"sst\":1,\"sd\":\"010203\"},\n    \"servingNetwork\":{\"mcc\":\"208\",\"mnc\":\"93\"},\n    \"accessType\":\"3GPP_ACCESS\",\n    \"notificationUri\":\"http://smf.free5gc.org:8000/npcf-smpolicycontrol/v1/notify\"\n  }\u0027\n```\n\nObserved response: `HTTP 500 Internal Server Error` with empty body.\n\nPCF container logs show:\n```\n[INFO][PCF][SMpolicy] Handle CreateSmPolicy\n[ERRO][PCF][Consumer] openapi error: 404, Not Found\n[ERRO][PCF][GIN] panic: runtime error: invalid memory address or nil pointer dereference\n  ...HandleCreateSmPolicyRequest at smpolicy.go:82...\n```\n\nThe Gin recovery middleware catches the panic (the captured stack trace runs inside `ginRecover.func2.1`), so the PCF process keeps serving other requests; the realized impact is per-request `HTTP 500` on this endpoint whenever the downstream lookup fails.\n\n### Impact\nNULL pointer dereference (CWE-476) caused by improper handling of an exceptional branch (CWE-754): the UDR-failure branch logs the OpenAPI error but does not return, then dereferences the nil response struct. The intended behavior is to return a controlled `4xx`/`5xx` `ProblemDetails` and stop processing.\n\nGin recovery catches the panic, so the PCF process is NOT killed and other endpoints continue serving. The realized impact is per-request: any unauthenticated POST that drives the downstream UDR lookup to a `404` returns `HTTP 500` (with empty body and a stack trace in PCF logs) instead of a controlled error response.\n\nNo Confidentiality impact (the response is `500` with empty body). No persistent Integrity impact (the panic happens before any state mutation). Availability impact is limited to per-request degradation. The endpoint remains reachable to unauthenticated attackers via the route-group auth gap separately tracked in free5gc/free5gc#844.\n\nAffected: free5gc v4.2.1 (originally reported against v4.1.0; same defect present).\n\nUpstream issue: https://github.com/free5gc/free5gc/issues/803\nUpstream fix: https://github.com/free5gc/pcf/pull/62",
  "id": "GHSA-wr8j-6chw-gm6p",
  "modified": "2026-06-08T23:47:04Z",
  "published": "2026-05-08T22:39:43Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/free5gc/free5gc/security/advisories/GHSA-wr8j-6chw-gm6p"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44316"
    },
    {
      "type": "WEB",
      "url": "https://github.com/free5gc/free5gc/issues/803"
    },
    {
      "type": "WEB",
      "url": "https://github.com/free5gc/pcf/pull/62"
    },
    {
      "type": "WEB",
      "url": "https://github.com/free5gc/pcf/commit/df535f5524314620715e842baf9723efbeb481a7"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/free5gc/free5gc"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "free5GC\u0027s PCF npcf-smpolicycontrol POST /sm-policies panics on downstream UDR/OpenAPI 404 via nil pointer dereference"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-44316 (GCVE-0-2026-44316)

CNVD-2026-37851

FKIE_CVE-2026-44316

GHSA-WR8J-6CHW-GM6P

Summary

Details

PoC

Impact

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour