PT-2026-39254 · Free5Gc+1 · Free5Gc+1
Linziyuu
·
Published
2026-05-08
·
Updated
2026-05-27
·
CVE-2026-44324
CVSS v3.1
6.5
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
free5GC versions prior to 4.2.2
Description
The UDR
nudr-dr handler in free5GC contains an issue where a single authenticated request can cause a panic. This occurs when a request is made to the endpoint "DELETE /subscription-data/{ueId}/{servingPlmnId}/ee-subscriptions/{subsId}/amf-subscriptions" and the provided ueId does not exist in the UESubsCollection. The system identifies the missing user and sets a 404 USER NOT FOUND error, but fails to stop execution. It subsequently attempts a Go type assertion on a nil interface using the RemoveAmfSubscriptionsInfoProcedure() function, leading to an interface conversion panic. While the Gin recovery mechanism converts this panic into an HTTP 500 error, the endpoint remains susceptible to repeated panics, which can be used to sustain a per-request denial-of-service (DoS) by increasing CPU and log write overhead.Recommendations
Update to version 4.2.2.
As a temporary workaround, restrict access to the "DELETE /subscription-data/{ueId}/{servingPlmnId}/ee-subscriptions/{subsId}/amf-subscriptions" endpoint to minimize the risk of exploitation.
Exploit
Fix
Incorrect Type Conversion or Cast
Improper Check for Exceptional Conditions
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Free5Gc
Github.Com/Free5Gc/Udm