PT-2026-39248 · Unknown · Free5Gc Bsf

Linziyuu · Published 2026-05-08 · Updated 2026-05-28 · CVE-2026-44318

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions free5GC BSF version 4.2.1

Description An unsynchronized write occurs on the global Subscriptions map within the BSF handler for the endpoint '/nbsf-management/v1/subscriptions/{subId}'. While the handler reads the map using a read-lock via the GetSubscription() function, the ReplaceIndividualSubcription() function writes to the same map without acquiring a mutex when a subscription does not exist. Under concurrent authenticated PUT requests, this leads to a concurrent map read and map write, causing the Go runtime to trigger a non-recoverable fatal error that terminates the process. This results in a denial-of-service (DoS) where the entire BSF service becomes unavailable until it is restarted. The attack requires a valid nbsf-management OAuth2 access token and targets the subId variable.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Race Condition

Weakness Enumeration

CWE-820

CWE-362

Related Identifiers

CVE-2026-44318

GHSA-27PH-8Q4F-H7M7

GO-2026-4994

Affected Products

Free5Gc Bsf

References · 9

• 🔥 https://github.com/free5gc/free5gc/issues/926 · Exploit
• 🔥 https://github.com/free5gc/free5gc/security/advisories/GHSA-27ph-8q4f-h7m7 · Exploit
• https://github.com/free5gc/bsf/pull/7 · Patch
• https://github.com/free5gc/bsf/commit/277908565fd628d974a13ef562b81a8b7b519ffa · Patch
• https://osv.dev/vulnerability/GHSA-27ph-8q4f-h7m7 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4994 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44318 · Security Note
• https://github.com/free5gc/free5gc · Note
• https://twitter.com/dailycve/status/2060131891160727954 · Twitter Post