Nil-Pointer Dereference in free5GC NEF Handler Affects 5G Core Network Implementation

CVE-2026-44322

What is CVE-2026-44322?

A nil-pointer dereference vulnerability in the PATCH /3gpp-pfd-management/v1/{afId}/transactions/{transId}/applications/{appId} handler of free5GC can lead to a panic when the upstream UDR call fails. This occurs specifically when the consumer wrapper returns an error along with a nil *ProblemDetails. As a consequence, the application may return a generic HTTP 500 error instead of a controlled response, potentially disrupting service and compromising user experience. The issue has been addressed in version 4.2.2.

References