Free5gc: Seventeen DoS Vulnerabilities Disclosed in Single Batch

Key findings

• Seventeen Denial of Service (DoS) vulnerabilities were disclosed for Free5gc on August 27, 2026.
• The vulnerabilities affect Free5gc versions 4.0.1 and 4.1.0, stemming from input validation flaws and NULL pointer dereferences.
• Several components are impacted, including NssaiAvailabilitySubscriptionCreate, CDR processing, and various handlers across NFV functions.
• Four CVEs (CVE-2026-30062, CVE-2026-30057, CVE-2026-30056, CVE-2026-30050) are rated High severity (CVSSv3 7.5).
• Users are advised to update to patched versions of Free5gc to prevent service disruptions.

On August 27, 2026, a batch of seventeen Denial of Service (DoS) vulnerabilities was disclosed for the Free5gc network function virtualization (NFV) platform. These vulnerabilities, all affecting version 4.0.1 and in some cases 4.1.0, were disclosed on the same day, indicating a coordinated disclosure event. The vulnerabilities primarily stem from improper input validation and NULL pointer dereferences across various components, including NssaiAvailabilitySubscriptionCreate, CDR processing, RechargePut, HandleGetSharedData, UDMC registration, HandleUpdate, complexQueryFilterSubprocess, buildFilter, NF Discovery, NGAP handler, NAS decoder, HTTPModifySubscription, and CreateUEContext. The disclosures highlight potential weaknesses in how Free5gc handles crafted requests and payloads, which could be exploited to disrupt network services.

The disclosed vulnerabilities span several functional areas within the Free5gc core network functions. Specifically, CVE-2026-30073 affects the NssaiAvailabilitySubscriptionCreate component, while CVE-2026-30072 and CVE-2026-30056 point to issues in CDR processing and the AMF NGAP Dispatcher, respectively. Several vulnerabilities, including CVE-2026-30071, CVE-2026-30070, CVE-2026-30068, CVE-2026-30067, CVE-2026-30064, CVE-2026-30063, CVE-2026-30058, CVE-2026-30057, and CVE-2026-30050, are attributed to improper input validation in various handlers and functions such as RechargePut, HandleGetSharedData, HandleUpdate, complexQueryFilterSubprocess, buildFilter, NF Discovery, HTTPModifySubscription, CreateUEContext, and ModifyAMFEventSubscriptionProcedure. Additionally, NULL pointer dereferences were identified in the UDMC registration handler (CVE-2026-30069) and CDR processing path (CVE-2026-30072). The NGAP handler (CVE-2026-30062) and NAS decoder (CVE-2026-30059) are also implicated, with issues arising from crafted NAS PDUs and Registration Request messages. Finally, CVE-2026-30060 and CVE-2026-30051 relate to parsing crafted SUCI data during UE registration and the CreateUEContextProcedure, respectively.

While no specific threat actors or in-the-wild exploitation campaigns were mentioned in the provided details, the sheer number of vulnerabilities disclosed simultaneously suggests a significant security oversight by the Free5gc development team. The impact of these vulnerabilities is primarily a Denial of Service (DoS), which could lead to network outages and disruption of telecommunications services. The high severity rating (CVSSv3 7.5) for CVE-2026-30062, CVE-2026-30057, CVE-2026-30056, and CVE-2026-30050 underscores the potential severity of these DoS attacks.

The affected versions are primarily Free5gc v4.0.1, with some vulnerabilities also impacting v4.1.0. It is crucial for users of Free5gc to update to patched versions as soon as they become available. The disclosures indicate that fixes are likely included in subsequent releases. Users should consult the official Free5gc advisories for specific version information and patch details. Given the nature of DoS vulnerabilities, immediate patching is recommended to prevent potential service disruptions.

This coordinated disclosure of seventeen DoS vulnerabilities in Free5gc highlights the importance of robust input validation and secure coding practices in the development of critical network infrastructure software. Users of Free5gc should prioritize updating their deployments to mitigate the risk of service disruption. Further monitoring of Free5gc security advisories is recommended for any subsequent patches or related vulnerability disclosures. The concentration of these issues in a single release cycle warrants a thorough review of the software's security posture.