free5GC CHF has Out-of-Bounds Slice Access that Leads to DoS
Description
free5GC is an open source 5G core network. free5GC CHF prior to version 1.2.2 has an out-of-bounds slice access vulnerability in the CHF nchf-convergedcharging service. A valid authenticated request to PUT /nchf-convergedcharging/v3/recharging/:ueId?ratingGroup=... can trigger a server-side panic in github.com/free5gc/chf/internal/sbi.(*Server).RechargePut(...) due to an out-of-range slice access. In the reported runtime, Gin recovery converts the panic into HTTP 500, but the recharge path remains remotely panic-triggerable and can be abused repeatedly to degrade recharge functionality and flood logs. In deployments without equivalent recovery handling, this panic may cause more severe service disruption. free5GC CHF patches the issue. Some workarounds are available: Restrict access to the nchf-convergedcharging recharge endpoint to strictly trusted NF callers only; apply rate limiting or network ACLs in front of the CHF SBI interface to reduce repeated panic-trigger attempts; if the recharge API is not required, temporarily disable or block external reachability to this route; and/or ensure panic recovery, monitoring, and alerting are enabled.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
free5GC CHF prior to 1.2.2 contains an out-of-bounds slice access in the RechargePut handler, allowing authenticated attackers to trigger a server panic via a crafted PUT request, enabling denial of service.
CVE-2026-32937 describes an out-of-bounds slice access vulnerability in free5GC's Charging Function (CHF) component, specifically in the nchf-convergedcharging service. The issue exists in the RechargePut handler, which processes PUT requests to /nchf-convergedcharging/v3/recharging/:ueId?ratingGroup=.... The handler improperly parses the rechargingInfo path parameter by splitting on underscores without validation, leading to an out-of-range slice access when the parameter lacks an underscore [2][3].
An attacker with valid authentication can exploit this by sending a crafted PUT request to the recharge endpoint. In the tested environment, a request for a legitimate UE session with a valid ratingGroup triggered a panic in the Go runtime due to the slice bounds violation [3]. The panic occurs inside github.com/free5gc/chf/internal/sbi.(*Server).RechargePut, and while Gin's recovery middleware converts it to an HTTP 500 response, the endpoint remains remotely panic-triggerable [2].
Repeatedly triggering the panic degrades the recharge functionality and floods the logs, constituting a denial-of-service condition. In deployments without equivalent panic recovery, the panic could cause more severe service disruption, including process termination [2].
The vulnerability is patched in free5GC CHF version 1.2.2 via commit 55af766, which changes the route pattern to use a query parameter for ratingGroup and adds input validation [4]. Workarounds include restricting endpoint access to trusted NF callers, applying rate limiting or ACLs, disabling the recharge API if not needed, and ensuring panic recovery and monitoring are in place [2].
AI Insight generated on May 18, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/free5gc/chfGo | < 1.2.2 | 1.2.2 |
Affected products
2- free5gc/chfv5Range: < 1.2.2
Patches
155af766f321aMerge pull request #61 from solar224/fix/issue-760-rechargeput-panic
1 file changed · +26 −8
internal/sbi/api_convergedcharging.go+26 −8 modified@@ -13,7 +13,6 @@ package sbi import ( "net/http" "strconv" - "strings" "github.com/gin-gonic/gin" @@ -54,7 +53,7 @@ func (s *Server) getConvergenChargingRoutes() []Route { }, { Method: http.MethodPut, - Pattern: "/recharging/:rechargingInfo", + Pattern: "/recharging/:ueId", APIFunc: s.RechargePut, }, } @@ -172,16 +171,35 @@ func (s *Server) RechargeGet(c *gin.Context) { } func (s *Server) RechargePut(c *gin.Context) { - rechargingInfo := c.Param("rechargingInfo") - ueIdRatingGroup := strings.Split(rechargingInfo, "_") - ueId := ueIdRatingGroup[0] - rgStr := ueIdRatingGroup[1] + ueId := c.Param("ueId") + rgStr := c.Query("ratingGroup") + + if rgStr == "" { + problemDetail := models.ProblemDetails{ + Title: "Missing ratingGroup", + Status: http.StatusBadRequest, + Detail: "ratingGroup query parameter is required", + } + logger.RechargingLog.Errorf("Missing ratingGroup for UE: %s", ueId) + c.Set(sbi.IN_PB_DETAILS_CTX_STR, http.StatusText(http.StatusBadRequest)) + c.JSON(http.StatusBadRequest, problemDetail) + return + } + rg, err := strconv.Atoi(rgStr) if err != nil { - logger.RechargingLog.Errorf("UE[%s] fail to recharge for rating group %s", ueId, rgStr) + problemDetail := models.ProblemDetails{ + Title: "Invalid ratingGroup", + Status: http.StatusBadRequest, + Detail: "ratingGroup must be a valid integer", + } + logger.RechargingLog.Errorf("UE[%s] invalid ratingGroup: %s", ueId, rgStr) + c.Set(sbi.IN_PB_DETAILS_CTX_STR, http.StatusText(http.StatusBadRequest)) + c.JSON(http.StatusBadRequest, problemDetail) + return } - logger.RechargingLog.Warnf("UE[%s] Recharg for rating group %d", ueId, rg) + logger.RechargingLog.Warnf("UE[%s] Recharge for rating group %d", ueId, rg) s.Processor().NotifyRecharge(ueId, int32(rg))
Vulnerability mechanics
Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
6- github.com/advisories/GHSA-6g43-577r-wf4xghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-32937ghsaADVISORY
- github.com/free5gc/chf/commit/55af766f321a00afa978e806548c96f8a7d2433eghsax_refsource_MISCWEB
- github.com/free5gc/chf/pull/61ghsax_refsource_MISCWEB
- github.com/free5gc/free5gc/issues/864ghsax_refsource_MISCWEB
- github.com/free5gc/free5gc/security/advisories/GHSA-6g43-577r-wf4xghsax_refsource_CONFIRMWEB
News mentions
0No linked articles in our index yet.