Open-Source 5G Core Network Implementation Vulnerability in free5GC

CVE-2026-44317

What is CVE-2026-44317?

In versions prior to 4.2.2 of free5GC, the PCF component's ability to handle specific authenticated requests improperly results in runtime errors. When a request is made with the 'ascReqData.suppFeat' set to '1', and the 'medComponents' contain an 'afAppId' but lack an 'AfRoutReq', the system fails to check for nil before dereferencing. This oversight leads to a panic and an HTTP 500 response due to an invalid memory address error, making it crucial for users to update to version 4.2.2 or later to mitigate this risk.

References