PT-2026-39246 · Free5Gc · Free5Gc

Linziyuu · Published 2026-05-08 · Updated 2026-05-27 · CVE-2026-44316

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions free5GC versions 4.1.0 through 4.2.1

Description A nil-pointer dereference occurs in the PCF HandleCreateSmPolicyRequest function when a downstream OpenAPI consumer call to the UDR lookup returns a 404 Not Found error. The handler logs the error but continues execution instead of returning, subsequently dereferencing a nil response struct. This results in an HTTP 500 Internal Server Error. The issue can be triggered via a POST request to the '/npcf-smpolicycontrol/v1/sm-policies' endpoint, specifically when providing input that causes the UDR lookup to fail, such as an unknown dnn variable. In version 4.2.1, this endpoint is accessible without an Authorization header.

Recommendations Update free5GC to a version that incorporates the fix from pull request 62 in the PCF repository. As a temporary workaround, restrict access to the '/npcf-smpolicycontrol/v1/sm-policies' endpoint to authorized users only to minimize the risk of unauthenticated exploitation.

Exploit

Fix

Improper Check for Exceptional Conditions

NULL Pointer Dereference

Weakness Enumeration

CWE-754

CWE-476

Related Identifiers

CVE-2026-44316

GHSA-WR8J-6CHW-GM6P

Affected Products

Free5Gc

References · 8

• 🔥 https://github.com/free5gc/free5gc/issues/803 · Exploit
• https://github.com/free5gc/free5gc/security/advisories/GHSA-wr8j-6chw-gm6p · Vendor Advisory
• https://github.com/free5gc/pcf/pull/62 · Patch
• https://github.com/free5gc/pcf/commit/df535f5524314620715e842baf9723efbeb481a7 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-44316 · Security Note
• https://osv.dev/vulnerability/GHSA-wr8j-6chw-gm6p · Vendor Advisory
• https://github.com/free5gc/free5gc · Note
• https://twitter.com/dailycve/status/2052923992428724234 · Twitter Post