PT-2026-26185 · Free5Gc · Free5Gc

Zfei10990-Cmd · Published 2026-03-18 · Updated 2026-03-27 · CVE-2026-33063

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions free5GC versions prior to 1.4.2 free5GC version 4.0.1

Description free5GC is an open source 5G core network. A flaw exists in the AUSF component where an improper null check can lead to a denial of service. Specifically, the GetSupiFromSuciSupiMap function attempts to convert an interface from interface{} to *context.SuciSupiMap without verifying if the underlying value is nil. If SuciSupiMap is nil, the code will panic, resulting in a complete denial of service for the AUSF authentication service. This issue affects deployments using the AUSF UE authentication service, accessible via the /nausf-auth/v1/ue-authentications API endpoint. An attacker can trigger this by sending a crafted UE authentication request.

Recommendations Upgrade free5GC to version 1.4.2 or later. Restrict access to the AUSF API endpoint /nausf-auth/v1/ue-authentications to trusted sources only.

Exploit

Fix

DoS

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2026-33063

GHSA-4JRW-92FG-4JWX

GO-2026-4754

SUSE-SU-2026:1135-1

Affected Products

Free5Gc

References · 152

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33063.json · Exploit
• https://github.com/free5gc/free5gc/security/advisories/GHSA-4jrw-92fg-4jwx · Vendor Advisory
• https://github.com/free5gc/ausf/pull/52 · Patch
• https://github.com/free5gc/ausf/commit/3b9ac4403c2756dc89a5ed3cdcefe688458588aa · Patch
• https://osv.dev/vulnerability/GO-2026-4754 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1135-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33063 · Security Note
• https://osv.dev/vulnerability/GHSA-4jrw-92fg-4jwx · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-33063 · Vendor Advisory
• https://github.com/free5gc/free5gc · Note
• https://github.com/free5gc/free5gc/issues/778 · Note
• https://suse.com/security/cve/CVE-2026-33621 · Note
• https://suse.com/security/cve/CVE-2026-29794 · Note
• https://suse.com/security/cve/CVE-2026-33066 · Note
• https://suse.com/security/cve/CVE-2026-33476 · Note