CVE-2026-5661

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-5661", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-04-06T07:48:14.498Z", "datePublished": "2026-04-06T14:08:19.647Z", "dateUpdated": "2026-04-06T14:55:09.634Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-04-06T14:08:19.647Z"}, "title": "Free5GC NGSetupRequest denial of service", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-404", "lang": "en", "description": "Denial of Service"}]}], "affected": [{"vendor": "n/a", "product": "Free5GC", "versions": [{"version": "4.2.0", "status": "affected"}], "cpes": ["cpe:2.3:a:free5gc:free5gc:*:*:*:*:*:*:*:*"], "modules": ["NGSetupRequest Handler"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in Free5GC 4.2.0. This affects an unknown function of the component NGSetupRequest Handler. Such manipulation leads to denial of service. The attack may be launched remotely. The exploit is publicly available and might be used."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 5.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-04-06T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-04-06T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-04-06T09:53:20.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "shovon0203 (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/vuln/355485", "name": "VDB-355485 | Free5GC NGSetupRequest denial of service", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/vuln/355485/cti", "name": "VDB-355485 | CTI Indicators (IOB, IOC, TTP)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/785896", "name": "Submit #785896 | Linux Foundation free5GC 4.2.0 State Synchronization Error", "tags": ["third-party-advisory"]}, {"url": "https://github.com/free5gc/free5gc/issues/832", "tags": ["issue-tracking"]}, {"url": "https://github.com/free5gc/amf/pull/201", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/user-attachments/files/25581199/amfcfg.yaml", "tags": ["exploit"]}, {"url": "https://github.com/free5gc/free5gc/", "tags": ["product"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-06T14:53:51.067978Z", "id": "CVE-2026-5661", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-06T14:55:09.634Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-5661", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-06T14:53:51.067978Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-06T14:54:19.016Z"}}], "cna": {"title": "Free5GC NGSetupRequest denial of service", "credits": [{"lang": "en", "type": "reporter", "value": "shovon0203 (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P/E:POC/RL:ND/RC:UR"}}], "affected": [{"cpes": ["cpe:2.3:a:free5gc:free5gc:*:*:*:*:*:*:*:*"], "vendor": "n/a", "modules": ["NGSetupRequest Handler"], "product": "Free5GC", "versions": [{"status": "affected", "version": "4.2.0"}]}], "timeline": [{"lang": "en", "time": "2026-04-06T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-04-06T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-04-06T09:53:20.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/355485", "name": "VDB-355485 | Free5GC NGSetupRequest denial of service", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/vuln/355485/cti", "name": "VDB-355485 | CTI Indicators (IOB, IOC, TTP)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/785896", "name": "Submit #785896 | Linux Foundation free5GC 4.2.0 State Synchronization Error", "tags": ["third-party-advisory"]}, {"url": "https://github.com/free5gc/free5gc/issues/832", "tags": ["issue-tracking"]}, {"url": "https://github.com/free5gc/amf/pull/201", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/user-attachments/files/25581199/amfcfg.yaml", "tags": ["exploit"]}, {"url": "https://github.com/free5gc/free5gc/", "tags": ["product"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in Free5GC 4.2.0. This affects an unknown function of the component NGSetupRequest Handler. Such manipulation leads to denial of service. The attack may be launched remotely. The exploit is publicly available and might be used."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-404", "description": "Denial of Service"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-04-06T14:08:19.647Z"}}}, "cveMetadata": {"cveId": "CVE-2026-5661", "state": "PUBLISHED", "dateUpdated": "2026-04-06T14:55:09.634Z", "dateReserved": "2026-04-06T07:48:14.498Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-04-06T14:08:19.647Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:free5gc:free5gc:*:*:*:*:*:*:*:*"], "modules": ["NGSetupRequest Handler"], "product": "Free5GC", "vendor": "n/a", "versions": [{"status": "affected", "version": "4.2.0"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in Free5GC 4.2.0. This affects an unknown function of the component NGSetupRequest Handler. Such manipulation leads to denial of service. The attack may be launched remotely. The exploit is publicly available and might be used."}], "id": "CVE-2026-5661", "lastModified": "2026-06-17T10:59:28.037", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-5661", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-06T14:53:51.067978Z", "version": "2.0.3"}}]}, "published": "2026-04-06T15:17:15.960", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/free5gc/amf/pull/201"}, {"source": "cna@vuldb.com", "url": "https://github.com/free5gc/free5gc/"}, {"source": "cna@vuldb.com", "url": "https://github.com/free5gc/free5gc/issues/832"}, {"source": "cna@vuldb.com", "url": "https://github.com/user-attachments/files/25581199/amfcfg.yaml"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/785896"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/355485"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/355485/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-404"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.2.0"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Free5GC", "source": "cna", "vendor": "n/a"}, "product": "free5gc", "vendor": "free5gc"}], "analysis": {"en": {"generated_at": "2026-04-06T17:42:39.425557+00:00", "value": {"mitigation_remediation": ["Apply the latest Free5GC patch that fixes NGSetupRequest handling (check the project\u2019s release notes for the specific commit or version).", "If a patch is not yet available, upgrade to a newer Free5GC release that incorporates the fix or rebuild from the updated source.", "While waiting for a patch, block or restrict external traffic to the NGSetupRequest endpoint using firewall or ACL rules.", "Continuously monitor system logs for repeated NGSetupRequest failures or crash indicators, and alert on abnormal patterns.", "If a fix remains unavailable, consider disabling the NGSetupRequest related functionality or migrating to an alternative 5G core implementation."], "summary": {"action": "Patch/Update", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "Free5GC is an open\u2011source 5G core network implementation. The vulnerability specifically affects version 4.2.0 and any builds derived from that code base. No other product versions or vendors are listed as impacted.", "description_and_impact": "A flaw exists in the NGSetupRequest handler in Free5GC version 4.2.0 that allows an attacker to manipulate the request so that the component crashes or becomes unresponsive, resulting in a denial of service. This disrupts critical 5G core network functions and can affect carrier operations. The issue stems from a logical error that was identified as CWE-404.", "risk_and_exploitability": "The CVSS score of 6.9 indicates a medium severity. Exploitation is possible remotely and the exploit code is publicly available, according to the description. No EPSS score is reported, and the vulnerability is not yet in the CISA KEV catalog, but the potential for widespread denial of service remains a concern for operators relying on the affected Free5GC release."}}}}, "created": "2026-04-06T20:14:31.478902+00:00", "updated": "2026-04-06T21:32:46.467381+00:00", "vendors": ["free5gc", "free5gc$PRODUCT$free5gc"]}