Concurrency Vulnerability in Free5GC's BSF Subscription Management

CVE-2026-44318

What is CVE-2026-44318?

In free5GC's BSF component prior to version 4.2.2, a concurrency issue is present in the subscription management process. The BSF PUT /nbsf-management/v1/subscriptions/{subId} handler does not properly synchronize access to the global Subscriptions map. When an authenticated PUT request is made and a subscription is not found, the system attempts to write back to the map without locking, leading to a race condition. This can occur when one goroutine reads from the map while another writes to it, resulting in a panic that causes the Go runtime to abort the process. The entire BSF service becomes unavailable until restarted. This vulnerability was mitigated in version 4.2.2.

References