CVE-2026-44319

Katalog CVE

CVSS 7.5 · High EPSS 0,66%

Kerentanan Improper Input Validation pada free5gc. Skor CVSS 3.1 7.5 (High) menurut github.com.

Deskripsi (NVD)

free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's NEF terminates the entire process when a stored PFD-subscription notifyUri cannot be reached. In PfdChangeNotifier.FlushNotifications(), the notifier calls NnefPFDmanagementNotify(...) and on any delivery error invokes logger.PFDManageLog.Fatal(err), which is os.Exit(1)-equivalent in Go. An attacker who can create a PFD subscription with an attacker-chosen notifyUri and then trigger a PFD change can deterministically kill NEF on the asynchronous delivery attempt -- the process exits with status 1, dropping NEF's entire SBI surface until restart. This vulnerability is fixed in 4.2.2.

Rincian

Terbit di NVD

27 Mei 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation
CWE-617: Reachable Assertion
CWE-755: Improper Handling of Exceptional Conditions

EPSS (30 hari)

0,66% peluang dieksploitasi; lebih tinggi dari 50,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/free5gc/free5gc/security/advisories/GHSA-rxrq-fv76-26pr exploit · advisory vendor
• https://github.com/free5gc/nef/commit/f110517b1189801950b50668a593398687049074 patch
• https://github.com/free5gc/nef/pull/25 issue tracking · patch
• https://github.com/free5gc/free5gc/issues/924 exploit · issue tracking