Unauthenticated Remote Code Execution in free5GC's SMF Component

CVE-2026-44328

What is CVE-2026-44328?

The free5GC project, an open-source 5G core network implementation, contains a vulnerability in its SMF component where, prior to version 4.2.2, the UPI management route group is mounted without the necessary inbound OAuth2 middleware. This leads to a critical flaw where the DELETE /upi/v1/upNodesLinks/{upNodeRef} request can cause a nil-pointer panic, resulting in a denial of service. An attacker can leverage this vulnerability, even without authentication, to manipulate the in-memory user-plane topology and crash the handler by sending a specially crafted request targeting any Access Node entry. This vulnerability has been rectified in version 4.2.2, and users are advised to upgrade to ensure their systems remain secure.

References