CVE-2026-33062: free5GC NRF DoS Vulnerability

CVE-2026-33062 Overview

CVE-2026-33062 is an Improper Input Validation vulnerability in free5GC, an open source 5G core network implementation. The vulnerability exists in the NRF (Network Repository Function) component prior to version 1.4.2 and can be exploited to cause a complete Denial of Service condition. The EncodeGroupId function fails to validate the length of split data before accessing array indices, allowing a remote attacker to crash the service by sending a crafted HTTP GET request with a malformed group-id-list parameter.

Critical Impact

Remote attackers can completely disable the NRF discovery service in 5G core network deployments by sending a single malformed HTTP request, resulting in network function discovery failures across the entire 5G infrastructure.

Affected Products

• free5GC NRF versions prior to 1.4.2
• All free5GC deployments using the NRF discovery service

Discovery Timeline

• 2026-03-20 - CVE-2026-33062 published to NVD
• 2026-03-20 - Last updated in NVD database

Technical Details for CVE-2026-33062

Vulnerability Analysis

This vulnerability stems from missing input validation in the EncodeGroupId function within the free5GC NRF component. The function processes the group-id-list parameter from incoming HTTP GET requests by splitting the input string using separator characters. However, the code directly accesses array indices [0], [1], and [2] without first verifying that the split operation produced an array with sufficient elements.

When an attacker provides a group-id-list parameter that does not contain enough separator characters, the array access operations attempt to read beyond the actual array bounds. In Go, this results in a runtime panic with an "index out of range" error, causing the entire NRF service to crash immediately.

The attack is particularly severe in 5G network environments because the NRF serves as a critical network function discovery service. When the NRF becomes unavailable, other network functions cannot discover or communicate with each other, effectively disrupting the entire 5G core network operation.

Root Cause

The root cause is an Improper Input Validation flaw (CWE-284) where the EncodeGroupId function fails to validate the structure and completeness of user-supplied input before processing it. The code assumes the input will always contain the expected number of separator-delimited values without defensive bounds checking. This unsafe assumption allows malformed input to trigger an unhandled array index out-of-bounds condition.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by:

1. Identifying an exposed free5GC NRF discovery service endpoint
2. Crafting an HTTP GET request with a malformed group-id-list parameter containing insufficient separator characters
3. Sending the request to the NRF API endpoint
4. The NRF service crashes with a Go panic, resulting in complete service unavailability

The attack can be repeated to maintain a persistent denial of service condition, preventing service recovery until protective measures are implemented.

Detection Methods for CVE-2026-33062

Indicators of Compromise

• NRF service crashes with Go panic messages containing "index out of range" errors
• Abnormal HTTP GET requests to NRF discovery endpoints with malformed group-id-list parameters
• Repeated NRF service restarts in container orchestration logs
• Network function registration and discovery failures across the 5G core

Detection Strategies

• Monitor NRF service logs for panic events and "index out of range" error messages
• Implement web application firewall rules to inspect group-id-list parameter format
• Set up alerting for NRF process crashes or container restart loops
• Analyze HTTP request patterns for malformed query parameters targeting discovery endpoints

Monitoring Recommendations

• Configure centralized logging for all free5GC NRF instances to capture crash events
• Implement health checks with rapid failure detection for the NRF discovery service
• Deploy network-level monitoring to detect unusual patterns of requests to NRF API endpoints
• Create dashboards tracking NRF service uptime and restart frequency

How to Mitigate CVE-2026-33062

Immediate Actions Required

• Upgrade free5GC NRF to version 1.4.2 or later immediately
• Restrict network access to the NRF API endpoint to trusted internal sources only
• Implement network segmentation to limit exposure of 5G core network functions
• Deploy a reverse proxy or API gateway with input validation capabilities in front of the NRF service

Patch Information

free5GC has released version 1.4.2 which contains the fix for this vulnerability. The patch adds proper input validation to the EncodeGroupId function to verify array length before accessing indices. Technical details of the fix are available in the GitHub Pull Request and the GitHub Commit Details. For additional context, see the GitHub Security Advisory.

Workarounds

• Restrict NRF API access to trusted network functions using firewall rules or network ACLs
• Deploy an API gateway or reverse proxy that validates query parameter formats before forwarding requests
• Implement rate limiting on NRF discovery endpoints to slow down potential exploitation attempts
• Consider running NRF behind a load balancer with health checks to enable automatic failover

# Example: Restrict NRF API access using iptables
# Allow only trusted 5G core network functions to access NRF
iptables -A INPUT -p tcp --dport 29510 -s 10.100.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 29510 -j DROP