CVE-2026-44316
free5GC: PCF npcf-smpolicycontrol POST /sm-policies panics on downstream UDR/OpenAPI 404 via nil pointer dereference
Description
free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's PCF POST /npcf-smpolicycontrol/v1/sm-policies handler (HandleCreateSmPolicyRequest) panics with a nil-pointer dereference when a downstream OpenAPI consumer call (UDR lookup) returns 404 Not Found and the consumer wrapper returns err != nil together with a nil response struct. The handler logs the OpenAPI error and continues executing instead of returning, then dereferences the nil response struct on a subsequent line and panics. Gin recovery converts the panic into HTTP 500, so a single attacker-shaped POST returns 500 instead of a clean 4xx whenever the downstream lookup fails. The PCF process keeps running. The trigger is a single POST containing input that causes the downstream UDR lookup to fail (e.g. an unknown DNN). In 4.2.1 this endpoint is also reachable WITHOUT an Authorization header because the PCF Npcf_SMPolicyControl route group is mounted without inbound auth middleware. This vulnerability is fixed in 4.2.2.
INFO
Published Date :
May 27, 2026, 5:16 p.m.
Last Modified :
Oct. 14, 2026, 8:10 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | HIGH | [email protected] |
Solution
- Update free5GC to version 4.2.2.
- Apply vendor patches if available.
- Ensure proper authorization headers are enforced.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-44316.
| URL | Resource |
|---|---|
| https://github.com/free5gc/free5gc/issues/803 | Exploit Issue Tracking |
| https://github.com/free5gc/free5gc/security/advisories/GHSA-wr8j-6chw-gm6p | Exploit Vendor Advisory |
| https://github.com/free5gc/pcf/commit/df535f5524314620715e842baf9723efbeb481a7 | Patch |
| https://github.com/free5gc/pcf/pull/62 | Issue Tracking Patch |
| https://github.com/free5gc/free5gc/issues/803 | Exploit Issue Tracking |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-44316 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-44316
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-44316 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-44316 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 14, 2026
Action Type Old Value New Value Added Translation Title: free5gc, Description: free5GC es una implementación de código abierto de la red central 5G. Antes de la versión 4.2.2, el gestor PCF POST /npcf-smpolicycontrol/v1/sm-policies de free5GC (HandleCreateSmPolicyRequest) entra en pánico con una desreferencia de puntero nulo cuando una llamada de consumidor OpenAPI descendente (búsqueda de UDR) devuelve 404 Not Found y el envoltorio del consumidor devuelve err != nil junto con una estructura de respuesta nula. El gestor registra el error OpenAPI y continúa ejecutándose en lugar de retornar, luego desreferencia la estructura de respuesta nula en una línea subsiguiente y entra en pánico. La recuperación de Gin convierte el pánico en HTTP 500, por lo que un único POST con forma de atacante devuelve 500 en lugar de un 4xx limpio cada vez que la búsqueda descendente falla. El proceso PCF sigue ejecutándose. El disparador es un único POST que contiene una entrada que hace que la búsqueda de UDR descendente falle (por ejemplo, un DNN desconocido). En la versión 4.2.1, este punto final también es accesible SIN un encabezado de autorización porque el grupo de rutas PCF Npcf_SMPolicyControl se monta sin middleware de autenticación de entrada. Esta vulnerabilidad se corrige en la versión 4.2.2. -
CVE Modified by [email protected]
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'free5gc', 'product': 'free5gc', 'versions': [{'status': 'affected', 'version': '< 4.2.2'}]}] -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 17, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-44316', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'poc'}, {'automatable': 'yes'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-05-27T17:54:26.642585Z'} -
Initial Analysis by [email protected]
May. 28, 2026
Action Type Old Value New Value Added CPE Configuration OR *cpe:2.3:a:free5gc:free5gc:*:*:*:*:*:*:*:* versions up to (excluding) 4.2.2 Added Reference Type CISA-ADP: https://github.com/free5gc/free5gc/issues/803 Types: Exploit, Issue Tracking Added Reference Type GitHub, Inc.: https://github.com/free5gc/free5gc/issues/803 Types: Exploit, Issue Tracking Added Reference Type GitHub, Inc.: https://github.com/free5gc/free5gc/security/advisories/GHSA-wr8j-6chw-gm6p Types: Exploit, Vendor Advisory Added Reference Type GitHub, Inc.: https://github.com/free5gc/pcf/commit/df535f5524314620715e842baf9723efbeb481a7 Types: Patch Added Reference Type GitHub, Inc.: https://github.com/free5gc/pcf/pull/62 Types: Issue Tracking, Patch -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
May. 27, 2026
Action Type Old Value New Value Added Reference https://github.com/free5gc/free5gc/issues/803 -
New CVE Received by [email protected]
May. 27, 2026
Action Type Old Value New Value Added Description free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's PCF POST /npcf-smpolicycontrol/v1/sm-policies handler (HandleCreateSmPolicyRequest) panics with a nil-pointer dereference when a downstream OpenAPI consumer call (UDR lookup) returns 404 Not Found and the consumer wrapper returns err != nil together with a nil response struct. The handler logs the OpenAPI error and continues executing instead of returning, then dereferences the nil response struct on a subsequent line and panics. Gin recovery converts the panic into HTTP 500, so a single attacker-shaped POST returns 500 instead of a clean 4xx whenever the downstream lookup fails. The PCF process keeps running. The trigger is a single POST containing input that causes the downstream UDR lookup to fail (e.g. an unknown DNN). In 4.2.1 this endpoint is also reachable WITHOUT an Authorization header because the PCF Npcf_SMPolicyControl route group is mounted without inbound auth middleware. This vulnerability is fixed in 4.2.2. Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Added CWE CWE-754 Added CWE CWE-476 Added Reference https://github.com/free5gc/free5gc/issues/803 Added Reference https://github.com/free5gc/free5gc/security/advisories/GHSA-wr8j-6chw-gm6p Added Reference https://github.com/free5gc/pcf/commit/df535f5524314620715e842baf9723efbeb481a7 Added Reference https://github.com/free5gc/pcf/pull/62