CVE-2026-1683: Free5GC SMF Denial of Service Vulnerability

CVE-2026-1683 Overview

A denial of service vulnerability has been identified in Free5GC SMF (Session Management Function) up to version 4.1.0. The vulnerability exists in the function HandlePfcpSessionReportRequest within the file internal/pfcp/handler/handler.go of the PFCP (Packet Forwarding Control Protocol) component. Improper resource release (CWE-404) allows remote attackers to cause a denial of service condition without requiring authentication.

Critical Impact
Remote attackers can exploit this vulnerability over the network to disrupt the SMF component in Free5GC deployments, potentially affecting 5G core network operations and session management capabilities.

Affected Products

Free5GC SMF up to version 4.1.0
Free5GC deployments utilizing the PFCP handler component
5G core network implementations based on Free5GC

Discovery Timeline

2026-01-30 - CVE-2026-1683 published to NVD
2026-02-04 - Last updated in NVD database

Technical Details for CVE-2026-1683

Vulnerability Analysis

This vulnerability is classified as Improper Release of Resources Before Removing Last Reference (CWE-404). The flaw resides in the PFCP session handling logic within the Free5GC SMF component. When processing PFCP Session Report Requests, the HandlePfcpSessionReportRequest function fails to properly manage resources, leading to a denial of service condition.

The vulnerability can be exploited remotely over the network without requiring any authentication or user interaction. An attacker can send specially crafted PFCP messages to the SMF component, causing resource exhaustion or service disruption. The exploit has been publicly disclosed, increasing the risk of exploitation in the wild.

Root Cause

The root cause is improper resource release handling in the HandlePfcpSessionReportRequest function located in internal/pfcp/handler/handler.go. The function does not adequately release resources before removing the last reference, which can lead to resource leaks and eventual service degradation or failure when handling malicious PFCP session report requests.

Attack Vector

The attack is network-based and can be executed remotely against exposed Free5GC SMF instances. The attacker does not require authentication or privileges to exploit this vulnerability. By sending manipulated PFCP Session Report Request messages to the SMF endpoint, an attacker can trigger the improper resource handling condition, resulting in denial of service.

The vulnerability affects the availability of the system without impacting confidentiality or integrity. Technical details and discussion are available in the GitHub Issue Discussion.

Detection Methods for CVE-2026-1683

Indicators of Compromise

Unusual volume of PFCP Session Report Request messages targeting the SMF component
SMF service becoming unresponsive or experiencing degraded performance
Resource exhaustion indicators such as memory or connection pool depletion on the SMF host
Unexpected service restarts of the Free5GC SMF component

Detection Strategies

Monitor PFCP traffic patterns for anomalous session report request volumes
Implement network intrusion detection rules for malformed or excessive PFCP messages targeting port 8805 (default PFCP port)
Deploy application-level logging to track HandlePfcpSessionReportRequest function execution and error conditions
Configure alerting for SMF service health degradation or unexpected process terminations

Monitoring Recommendations

Enable detailed logging for the PFCP handler component in Free5GC SMF
Monitor system resource utilization (memory, CPU, file descriptors) on SMF hosts
Implement network flow analysis to detect unusual traffic patterns to SMF endpoints
Set up automated health checks for the SMF service with appropriate alerting thresholds

How to Mitigate CVE-2026-1683

Immediate Actions Required

Review network exposure of Free5GC SMF instances and restrict access to trusted networks only
Implement network-level rate limiting for PFCP traffic to the SMF component
Monitor SMF service health and resource utilization for signs of exploitation
Apply the available patch from the GitHub Pull Request

Patch Information

A patch addressing this vulnerability is available via GitHub Pull Request #188 in the Free5GC SMF repository. Organizations running affected versions of Free5GC SMF should apply this patch or upgrade to a patched version as soon as possible. Additional vulnerability details are documented in the VulDB entry #343476.

Workarounds

Restrict network access to the SMF PFCP interface using firewall rules to allow only trusted sources
Implement rate limiting at the network or application level to mitigate potential denial of service attacks
Deploy the SMF component behind a reverse proxy or load balancer with request filtering capabilities
Consider temporarily disabling the affected PFCP handler if not critical to operations until patching is complete

bash

# Example firewall configuration to restrict PFCP access
# Restrict PFCP port (8805) to trusted network segments only
iptables -A INPUT -p udp --dport 8805 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p udp --dport 8805 -j DROP