CVE-2026-33063 Overview
CVE-2026-33063 is a Null Pointer Dereference vulnerability in the free5GC open source 5G core network Authentication Server Function (AUSF) component. Prior to version 1.4.2, the AUSF service contains an Improper Null Check vulnerability in the GetSupiFromSuciSupiMap function that allows remote attackers to cause a complete denial of service by sending specially crafted UE authentication requests.
The vulnerability exists because the GetSupiFromSuciSupiMap function attempts to perform an interface conversion from interface{} to *context.SuciSupiMap without first verifying that the underlying value is not nil. When SuciSupiMap is nil, the code panics with the error "interface conversion: interface {} is nil, not *context.SuciSupiMap", causing the entire AUSF service to crash.
Critical Impact
Remote attackers can crash the AUSF authentication service, disrupting 5G UE authentication for all users relying on the affected free5GC deployment.
Affected Products
- free5GC AUSF versions prior to 1.4.2
- free5GC v4.0.1 deployments using the AUSF UE authentication service
- All deployments exposing the /nausf-auth/v1/ue-authentications endpoint
Discovery Timeline
- 2026-03-20 - CVE-2026-33063 published to NVD
- 2026-03-20 - Last updated in NVD database
Technical Details for CVE-2026-33063
Vulnerability Analysis
This vulnerability is classified as CWE-476 (NULL Pointer Dereference), which occurs when an application dereferences a pointer that it expects to be valid but is actually NULL. In the context of Go programming, this manifests as a nil interface conversion panic.
The vulnerable code path is triggered when a UE authentication request is processed through the /nausf-auth/v1/ue-authentications endpoint. The GetSupiFromSuciSupiMap function is called during this process to retrieve SUPI (Subscription Permanent Identifier) information from the SUCI-SUPI mapping structure. However, the function lacks proper null checking before attempting the interface type assertion.
In Go, when performing a type assertion on an interface value that holds nil, the assertion fails catastrophically with a runtime panic rather than returning an error. This design requires developers to explicitly check for nil values before type assertions, which was not implemented in the vulnerable code path.
Root Cause
The root cause of CVE-2026-33063 is missing nil validation in the GetSupiFromSuciSupiMap function. The code assumes that SuciSupiMap will always contain a valid pointer to a *context.SuciSupiMap structure, but under certain conditions—such as incomplete initialization or specific request patterns—this value can be nil.
The absence of defensive programming practices, specifically a nil check before the interface conversion, allows the panic condition to propagate and terminate the AUSF service process entirely.
Attack Vector
The attack vector for this vulnerability is network-based and requires no authentication. An attacker can exploit this vulnerability by:
- Identifying a free5GC deployment with an exposed AUSF service
- Crafting a malicious UE authentication request targeting the /nausf-auth/v1/ue-authentications endpoint
- Sending the request with parameters that cause SuciSupiMap to be nil during processing
- The AUSF service panics and crashes, denying authentication services to all legitimate users
The vulnerability mechanism involves improper interface handling in Go. When the code attempts to convert an interface value to a concrete type without checking for nil, the Go runtime raises an unrecoverable panic. In a service context without proper panic recovery handlers, this causes process termination.
For technical implementation details, refer to the GitHub Security Advisory and the related GitHub Issue.
Detection Methods for CVE-2026-33063
Indicators of Compromise
- AUSF service unexpectedly crashing or restarting repeatedly
- Error logs containing "interface conversion: interface {} is nil, not *context.SuciSupiMap"
- Go runtime panic stack traces originating from GetSupiFromSuciSupiMap function
- Abnormal volume of requests to the /nausf-auth/v1/ue-authentications endpoint
Detection Strategies
- Monitor AUSF service health and uptime, alerting on unexpected restarts or crashes
- Implement log analysis rules to detect Go panic messages containing nil interface conversion errors
- Deploy network intrusion detection signatures for malformed UE authentication requests
- Track API endpoint metrics for /nausf-auth/v1/ue-authentications to identify anomalous request patterns
Monitoring Recommendations
- Enable process monitoring for the AUSF service with automatic alerting on crashes
- Configure centralized logging to capture and analyze Go panic stack traces in real-time
- Implement request rate limiting and anomaly detection on the AUSF authentication endpoint
- Set up availability monitoring to detect service disruptions indicative of DoS attacks
How to Mitigate CVE-2026-33063
Immediate Actions Required
- Upgrade free5GC AUSF to version 1.4.2 or later immediately
- Restrict network access to the AUSF API to trusted sources only using firewall rules
- Implement API gateway rate limiting to reduce DoS attack impact
- Enable service monitoring with automatic restart capabilities as a temporary safeguard
Patch Information
free5GC has released version 1.4.2 of the AUSF component which addresses this vulnerability. The fix implements proper nil checking before the interface conversion in the GetSupiFromSuciSupiMap function.
The patch is available through the following resources:
Organizations should update to AUSF version 1.4.2 or apply the commit 3b9ac4403c2756dc89a5ed3cdcefe688458588aa to address this vulnerability.
Workarounds
- Restrict access to the AUSF API endpoint to trusted network sources only using network segmentation
- Deploy a reverse proxy or API gateway with strict request validation in front of the AUSF service
- Implement network-level access controls to limit exposure of the /nausf-auth/v1/ue-authentications endpoint
- Configure container orchestration or systemd to automatically restart the AUSF service upon crash
# Example: Restrict AUSF API access using iptables
# Allow only trusted 5G network functions to access AUSF port
iptables -A INPUT -p tcp --dport 29509 -s 10.5.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 29509 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
