PT-2026-39253 · Free5Gc+1 · Free5Gc+1

Linziyuu · Published 2026-05-08 · Updated 2026-05-27 · CVE-2026-44323

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions free5GC versions prior to 4.2.2

Description The UDR nudr-dr handler for the endpoint "DELETE /subscription-data/{ueId}/{servingPlmnId}/ee-subscriptions/{subsId}/amf-subscriptions" contains a nil-pointer dereference. This occurs when a request is made with a nonexistent subsId after a preparatory authenticated EE-subscription has been created to allocate UE state. The handler identifies the missing entry and sets a 404 error but fails to return, subsequently attempting to access UESubsData.EeSubscriptionCollection[subsId].AmfSubscriptionInfos. This results in a runtime panic that is converted into an HTTP 500 error by the Gin recovery mechanism. An authenticated attacker with a valid nudr-dr OAuth2 access token can repeatedly trigger this panic, leading to a denial-of-service (DoS) through resource degradation.

Recommendations Update to version 4.2.2.

Exploit

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2026-44323

GHSA-4RQF-GRM6-VF75

Affected Products

Free5Gc

Github.Com/Free5Gc/Udm

References · 7

• 🔥 https://github.com/free5gc/free5gc/issues/919 · Exploit
• https://github.com/free5gc/free5gc/security/advisories/GHSA-4rqf-grm6-vf75 · Vendor Advisory
• https://github.com/free5gc/udr/commit/8a1d3c63be99d378806d771f086ff32f1867da99 · Patch
• https://github.com/free5gc/udr/pull/60 · Patch
• https://osv.dev/vulnerability/GHSA-4rqf-grm6-vf75 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44323 · Security Note
• https://github.com/free5gc/free5gc · Note