PT-2026-39252 · Free5Gc+1 · Free5Gc+1
Linziyuu
·
Published
2026-05-08
·
Updated
2026-05-28
·
CVE-2026-44322
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
free5GC versions prior to 4.2.2
Description
The Network Exposure Function (NEF) in free5GC contains a nil-pointer dereference issue within the
PatchIndividualApplicationPFDManagement() function. This occurs when a PATCH request is sent to the endpoint "/3gpp-pfd-management/v1/{afId}/transactions/{transId}/applications/{appId}" while the upstream Unified Data Repository (UDR) call fails and the consumer wrapper returns an error with a nil *ProblemDetails object. In this specific error branch, the handler attempts to read problemDetails.Cause despite problemDetails being nil, leading to a runtime panic. The Gin recovery mechanism converts this panic into an HTTP 500 Internal Server Error. This issue can be triggered without an Authorization header as the route group is mounted without inbound authentication middleware.Recommendations
Update to version 4.2.2.
As a temporary workaround, restrict access to the "/3gpp-pfd-management/v1/{afId}/transactions/{transId}/applications/{appId}" endpoint to minimize the risk of exploitation.
Exploit
Fix
NULL Pointer Dereference
Improper Check for Exceptional Conditions
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Free5Gc
Github.Com/Free5Gc/Nef