CVE-2026-44316

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-44316", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-05T19:00:06.022Z", "datePublished": "2026-05-27T15:52:07.224Z", "dateUpdated": "2026-05-27T17:54:45.817Z"}, "containers": {"cna": {"title": "free5GC: PCF npcf-smpolicycontrol POST /sm-policies panics on downstream UDR/OpenAPI 404 via nil pointer dereference", "problemTypes": [{"descriptions": [{"cweId": "CWE-476", "lang": "en", "description": "CWE-476: NULL Pointer Dereference", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-754", "lang": "en", "description": "CWE-754: Improper Check for Unusual or Exceptional Conditions", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/free5gc/free5gc/security/advisories/GHSA-wr8j-6chw-gm6p", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/free5gc/free5gc/security/advisories/GHSA-wr8j-6chw-gm6p"}, {"name": "https://github.com/free5gc/free5gc/issues/803", "tags": ["x_refsource_MISC"], "url": "https://github.com/free5gc/free5gc/issues/803"}, {"name": "https://github.com/free5gc/pcf/pull/62", "tags": ["x_refsource_MISC"], "url": "https://github.com/free5gc/pcf/pull/62"}, {"name": "https://github.com/free5gc/pcf/commit/df535f5524314620715e842baf9723efbeb481a7", "tags": ["x_refsource_MISC"], "url": "https://github.com/free5gc/pcf/commit/df535f5524314620715e842baf9723efbeb481a7"}], "affected": [{"vendor": "free5gc", "product": "free5gc", "versions": [{"version": "< 4.2.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-27T15:52:07.224Z"}, "descriptions": [{"lang": "en", "value": "free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's PCF POST /npcf-smpolicycontrol/v1/sm-policies handler (HandleCreateSmPolicyRequest) panics with a nil-pointer dereference when a downstream OpenAPI consumer call (UDR lookup) returns 404 Not Found and the consumer wrapper returns err != nil together with a nil response struct. The handler logs the OpenAPI error and continues executing instead of returning, then dereferences the nil response struct on a subsequent line and panics. Gin recovery converts the panic into HTTP 500, so a single attacker-shaped POST returns 500 instead of a clean 4xx whenever the downstream lookup fails. The PCF process keeps running. The trigger is a single POST containing input that causes the downstream UDR lookup to fail (e.g. an unknown DNN). In 4.2.1 this endpoint is also reachable WITHOUT an Authorization header because the PCF Npcf_SMPolicyControl route group is mounted without inbound auth middleware. This vulnerability is fixed in 4.2.2."}], "source": {"advisory": "GHSA-wr8j-6chw-gm6p", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/free5gc/free5gc/issues/803", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-27T17:54:26.642585Z", "id": "CVE-2026-44316", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-27T17:54:45.817Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-44316", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-27T17:54:26.642585Z"}}}], "references": [{"url": "https://github.com/free5gc/free5gc/issues/803", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-27T17:54:41.727Z"}}], "cna": {"title": "free5GC: PCF npcf-smpolicycontrol POST /sm-policies panics on downstream UDR/OpenAPI 404 via nil pointer dereference", "source": {"advisory": "GHSA-wr8j-6chw-gm6p", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "free5gc", "product": "free5gc", "versions": [{"status": "affected", "version": "< 4.2.2"}]}], "references": [{"url": "https://github.com/free5gc/free5gc/security/advisories/GHSA-wr8j-6chw-gm6p", "name": "https://github.com/free5gc/free5gc/security/advisories/GHSA-wr8j-6chw-gm6p", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/free5gc/free5gc/issues/803", "name": "https://github.com/free5gc/free5gc/issues/803", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/free5gc/pcf/pull/62", "name": "https://github.com/free5gc/pcf/pull/62", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/free5gc/pcf/commit/df535f5524314620715e842baf9723efbeb481a7", "name": "https://github.com/free5gc/pcf/commit/df535f5524314620715e842baf9723efbeb481a7", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's PCF POST /npcf-smpolicycontrol/v1/sm-policies handler (HandleCreateSmPolicyRequest) panics with a nil-pointer dereference when a downstream OpenAPI consumer call (UDR lookup) returns 404 Not Found and the consumer wrapper returns err != nil together with a nil response struct. The handler logs the OpenAPI error and continues executing instead of returning, then dereferences the nil response struct on a subsequent line and panics. Gin recovery converts the panic into HTTP 500, so a single attacker-shaped POST returns 500 instead of a clean 4xx whenever the downstream lookup fails. The PCF process keeps running. The trigger is a single POST containing input that causes the downstream UDR lookup to fail (e.g. an unknown DNN). In 4.2.1 this endpoint is also reachable WITHOUT an Authorization header because the PCF Npcf_SMPolicyControl route group is mounted without inbound auth middleware. This vulnerability is fixed in 4.2.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-476", "description": "CWE-476: NULL Pointer Dereference"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-754", "description": "CWE-754: Improper Check for Unusual or Exceptional Conditions"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-27T15:52:07.224Z"}}}, "cveMetadata": {"cveId": "CVE-2026-44316", "state": "PUBLISHED", "dateUpdated": "2026-05-27T17:54:45.817Z", "dateReserved": "2026-05-05T19:00:06.022Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-27T15:52:07.224Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "free5gc", "vendor": "free5gc", "versions": [{"status": "affected", "version": "< 4.2.2"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:free5gc:free5gc:*:*:*:*:*:*:*:*", "matchCriteriaId": "EF7EBB95-EB4E-44C5-BF0A-9C99B0A7775F", "versionEndExcluding": "4.2.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's PCF POST /npcf-smpolicycontrol/v1/sm-policies handler (HandleCreateSmPolicyRequest) panics with a nil-pointer dereference when a downstream OpenAPI consumer call (UDR lookup) returns 404 Not Found and the consumer wrapper returns err != nil together with a nil response struct. The handler logs the OpenAPI error and continues executing instead of returning, then dereferences the nil response struct on a subsequent line and panics. Gin recovery converts the panic into HTTP 500, so a single attacker-shaped POST returns 500 instead of a clean 4xx whenever the downstream lookup fails. The PCF process keeps running. The trigger is a single POST containing input that causes the downstream UDR lookup to fail (e.g. an unknown DNN). In 4.2.1 this endpoint is also reachable WITHOUT an Authorization header because the PCF Npcf_SMPolicyControl route group is mounted without inbound auth middleware. This vulnerability is fixed in 4.2.2."}, {"lang": "es", "value": "free5GC es una implementaci\u00f3n de c\u00f3digo abierto de la red central 5G. Antes de la versi\u00f3n 4.2.2, el gestor PCF POST /npcf-smpolicycontrol/v1/sm-policies de free5GC (HandleCreateSmPolicyRequest) entra en p\u00e1nico con una desreferencia de puntero nulo cuando una llamada de consumidor OpenAPI descendente (b\u00fasqueda de UDR) devuelve 404 Not Found y el envoltorio del consumidor devuelve err != nil junto con una estructura de respuesta nula. El gestor registra el error OpenAPI y contin\u00faa ejecut\u00e1ndose en lugar de retornar, luego desreferencia la estructura de respuesta nula en una l\u00ednea subsiguiente y entra en p\u00e1nico. La recuperaci\u00f3n de Gin convierte el p\u00e1nico en HTTP 500, por lo que un \u00fanico POST con forma de atacante devuelve 500 en lugar de un 4xx limpio cada vez que la b\u00fasqueda descendente falla. El proceso PCF sigue ejecut\u00e1ndose. El disparador es un \u00fanico POST que contiene una entrada que hace que la b\u00fasqueda de UDR descendente falle (por ejemplo, un DNN desconocido). En la versi\u00f3n 4.2.1, este punto final tambi\u00e9n es accesible SIN un encabezado de autorizaci\u00f3n porque el grupo de rutas PCF Npcf_SMPolicyControl se monta sin middleware de autenticaci\u00f3n de entrada. Esta vulnerabilidad se corrige en la versi\u00f3n 4.2.2."}], "id": "CVE-2026-44316", "lastModified": "2026-10-14T20:10:00.190", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44316", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-27T17:54:26.642585Z", "version": "2.0.3"}}]}, "published": "2026-05-27T17:16:36.570", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Issue Tracking"], "url": "https://github.com/free5gc/free5gc/issues/803"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/free5gc/free5gc/security/advisories/GHSA-wr8j-6chw-gm6p"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/free5gc/pcf/commit/df535f5524314620715e842baf9723efbeb481a7"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/free5gc/pcf/pull/62"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Issue Tracking"], "url": "https://github.com/free5gc/free5gc/issues/803"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-476"}, {"lang": "en", "value": "CWE-754"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.2.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "free5gc", "source": "cna", "vendor": "free5gc"}, "product": "free5gc", "vendor": "free5gc"}], "created": "2026-05-27T19:30:35.586679+00:00", "updated": "2026-05-28T04:30:06.666280+00:00", "vendors": ["free5gc", "free5gc$PRODUCT$free5gc"]}