CVE-2026-26024: Free5gc SMF DOS Vulnerability

CVE-2026-26024 Overview

CVE-2026-26024 is a Null Pointer Dereference vulnerability affecting free5GC SMF (Session Management Function), a critical component of the free5GC open-source project for 5th generation (5G) mobile core networks. The vulnerability allows remote attackers to cause a denial of service condition by sending malformed PFCP SessionReportRequest messages to the SMF's PFCP interface on UDP port 8805.

When the SMF processes a specially crafted malformed PFCP SessionReportRequest, the application panics and terminates, disrupting session management operations for the entire 5G core network. This vulnerability poses a significant risk to telecommunications infrastructure relying on free5GC deployments.

Critical Impact
Remote attackers can crash the free5GC Session Management Function by sending malformed PFCP messages, causing denial of service to 5G network session management operations.

Affected Products

free5GC SMF versions up to and including 1.4.1
free5GC deployments using the SMF component (Go implementation)
5G core network infrastructure utilizing free5GC SMF for session management

Discovery Timeline

2026-02-24 - CVE-2026-26024 published to NVD
2026-02-25 - Last updated in NVD database

Technical Details for CVE-2026-26024

Vulnerability Analysis

This vulnerability is classified as CWE-476 (NULL Pointer Dereference). The free5GC SMF component fails to properly validate incoming PFCP (Packet Forwarding Control Protocol) SessionReportRequest messages before processing them. When a malformed message is received on the PFCP interface (UDP/8805), the handler attempts to access memory through a null pointer, causing the entire SMF process to panic and terminate.

The attack is network-accessible without requiring authentication or user interaction. An attacker can trigger this condition remotely by sending specially crafted UDP packets to the PFCP interface. Since PFCP is used for communication between the SMF and User Plane Function (UPF) components in a 5G architecture, disrupting the SMF can impact the entire session management plane of the mobile core network.

Root Cause

The root cause is insufficient input validation in the PFCP message handler within the free5GC SMF component. When processing SessionReportRequest messages, the code does not verify that all required fields are present and valid before attempting to dereference pointers. A malformed message with missing or invalid fields triggers a null pointer dereference, which in Go results in a panic that terminates the process when unhandled.

The vulnerability is exacerbated by the absence of panic recovery mechanisms (recover()) around the PFCP handler dispatch, meaning a single malformed packet can crash the entire SMF service.

Attack Vector

The attack is executed over the network by sending malformed PFCP SessionReportRequest messages to the target SMF's UDP port 8805. The PFCP interface is designed for trusted communication between the SMF and UPF components, but if this interface is exposed to untrusted networks or if an attacker can spoof packets from a trusted UPF IP address, exploitation becomes trivial.

The vulnerability does not require authentication, making it accessible to any attacker with network access to the PFCP interface. A single malformed packet is sufficient to trigger the crash condition, making this a low-complexity attack.

For detailed technical information about the vulnerability, refer to the GitHub Security Advisory GHSA-mrv4-m9wc-c4g9 and GitHub Issue #807.

Detection Methods for CVE-2026-26024

Indicators of Compromise

Unexpected SMF process crashes or restarts in log files
Elevated rate of incoming PFCP packets on UDP port 8805, especially from unexpected source IPs
Malformed or incomplete PFCP SessionReportRequest messages in network traffic captures
Service disruptions in 5G session management operations coinciding with SMF process terminations

Detection Strategies

Monitor SMF process health and implement alerting for unexpected crashes or panic conditions
Deploy network intrusion detection systems (NIDS) to inspect PFCP traffic for malformed SessionReportRequest messages
Implement logging at the network edge to capture PFCP traffic anomalies before they reach the SMF
Configure application-level monitoring to detect and alert on Go panic events in SMF logs

Monitoring Recommendations

Establish baseline metrics for normal PFCP traffic patterns and alert on deviations
Monitor for repeated SMF restarts within short time windows, which may indicate ongoing exploitation attempts
Implement deep packet inspection for PFCP traffic where feasible to identify malformed messages
Review firewall and ACL logs for unauthorized connection attempts to the PFCP interface (UDP/8805)

How to Mitigate CVE-2026-26024

Immediate Actions Required

Restrict access to the PFCP interface (UDP/8805) using ACLs or firewall rules to allow only trusted UPF IP addresses
Implement network segmentation to isolate the PFCP interface from untrusted networks
Deploy edge-level filtering to drop or inspect malformed PFCP SessionReportRequest messages before they reach the SMF
Consider adding recover() handlers around PFCP handler dispatch in the SMF code as a mitigation to prevent complete process termination

Patch Information

No official upstream patch is currently available for this vulnerability. The free5GC project has acknowledged the issue through their GitHub Security Advisory. Organizations should monitor the free5GC repository for updates and apply patches as soon as they become available.

Workarounds

Apply ACL/firewall rules to the PFCP interface so only trusted UPF IP addresses can communicate with the SMF, reducing the spoofing and abuse surface
Implement network-level inspection at the edge to drop malformed PFCP SessionReportRequest messages before they reach the SMF
Add recover() panic handlers around PFCP handler dispatch in the SMF code to prevent whole-process termination (mitigation only, does not fix the underlying issue)
Deploy SMF instances behind a PFCP-aware proxy or load balancer capable of filtering malformed messages

bash

# Example firewall rule to restrict PFCP access (iptables)
# Allow PFCP traffic only from trusted UPF IP addresses
iptables -A INPUT -p udp --dport 8805 -s <TRUSTED_UPF_IP_1> -j ACCEPT
iptables -A INPUT -p udp --dport 8805 -s <TRUSTED_UPF_IP_2> -j ACCEPT
iptables -A INPUT -p udp --dport 8805 -j DROP