PT-2026-66852 · Free5Gc · Free5Gc

CVE-2026-53551 · Published 2026-07-31 · Updated 2026-07-31

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions free5GC versions prior to 1.4.5

Description The AUSF (Authentication Server Function) fails to validate the supiOrSuci field in UE authentication requests. Null bytes (x00) and other control characters are passed through JSON parsing and forwarded to the UDM in an unescaped URL path. This causes the net/url.Parse() function to fail, resulting in an HTTP 500 System failure and the leakage of internal stack traces. An unauthenticated attacker can exploit this at the POST /nausf-auth/v1/ue-authentications endpoint to cause a denial of service for all subscribers attempting authentication through the affected AUSF.

Recommendations Update to version 1.4.5. As a temporary workaround, restrict access to the POST /nausf-auth/v1/ue-authentications endpoint to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2026-53551

GHSA-QJ55-47FP-P62J

Affected Products

Free5Gc

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-53551 · Security Note
• https://osv.dev/vulnerability/GHSA-qj55-47fp-p62j · Vendor Advisory
• https://github.com/free5gc/free5gc/releases/tag/v4.2.2 · Note
• https://github.com/free5gc/free5gc/issues/1048 · Note
• https://github.com/free5gc/free5gc/security/advisories/GHSA-qj55-47fp-p62j · Note
• https://github.com/free5gc/free5gc · Note
• https://github.com/free5gc/ausf/commit/bfc4a10094dbacbd862baa4686829f3fcc06ce1e · Note
• https://github.com/free5gc/ausf/pull/61 · Note
• https://github.com/free5gc/ausf/releases/tag/v1.4.5 · Note