Memory Leak Vulnerability in free5GC's UDR Affecting Policy Control Function

CVE-2026-41135

What is CVE-2026-41135?

The free5GC UDR, part of an open-source project for 5G mobile core networks, is susceptible to a memory leak vulnerability. This issue affects versions prior to 1.4.3, allowing unauthenticated attackers with network access to exploit the Policy Control Function (PCF) by repeatedly sending HTTP requests to the Operations and Management (OAM) endpoint. The vulnerability arises from an improper use of router.Use(), which registers a new CORS middleware for each incoming request, leading to an unchecked growth in the Gin router's handler chain. Consequently, this can cause progressive memory exhaustion and lead to a Denial of Service, obstructing all User Equipment (UEs) from accessing AM and SM policies and hindering 5G session establishment. Version 1.4.3 provides a fix for this vulnerability.

References