CVE-2026-33063: free5GC AUSF Denial of Service Vulnerability

CVE-2026-33063 Overview

CVE-2026-33063 is a Null Pointer Dereference vulnerability in the free5GC open source 5G core network Authentication Server Function (AUSF) component. Prior to version 1.4.2, the AUSF service contains an Improper Null Check vulnerability in the GetSupiFromSuciSupiMap function that allows remote attackers to cause a complete denial of service by sending specially crafted UE authentication requests.

The vulnerability exists because the GetSupiFromSuciSupiMap function attempts to perform an interface conversion from interface{} to *context.SuciSupiMap without first verifying that the underlying value is not nil. When SuciSupiMap is nil, the code panics with the error "interface conversion: interface {} is nil, not *context.SuciSupiMap", causing the entire AUSF service to crash.

Critical Impact
Remote attackers can crash the AUSF authentication service, disrupting 5G UE authentication for all users relying on the affected free5GC deployment.

Affected Products

free5GC AUSF versions prior to 1.4.2
free5GC v4.0.1 deployments using the AUSF UE authentication service
All deployments exposing the /nausf-auth/v1/ue-authentications endpoint

Discovery Timeline

2026-03-20 - CVE-2026-33063 published to NVD
2026-03-20 - Last updated in NVD database

Technical Details for CVE-2026-33063

Vulnerability Analysis

This vulnerability is classified as CWE-476 (NULL Pointer Dereference), which occurs when an application dereferences a pointer that it expects to be valid but is actually NULL. In the context of Go programming, this manifests as a nil interface conversion panic.

The vulnerable code path is triggered when a UE authentication request is processed through the /nausf-auth/v1/ue-authentications endpoint. The GetSupiFromSuciSupiMap function is called during this process to retrieve SUPI (Subscription Permanent Identifier) information from the SUCI-SUPI mapping structure. However, the function lacks proper null checking before attempting the interface type assertion.

In Go, when performing a type assertion on an interface value that holds nil, the assertion fails catastrophically with a runtime panic rather than returning an error. This design requires developers to explicitly check for nil values before type assertions, which was not implemented in the vulnerable code path.

Root Cause

The root cause of CVE-2026-33063 is missing nil validation in the GetSupiFromSuciSupiMap function. The code assumes that SuciSupiMap will always contain a valid pointer to a *context.SuciSupiMap structure, but under certain conditions—such as incomplete initialization or specific request patterns—this value can be nil.

The absence of defensive programming practices, specifically a nil check before the interface conversion, allows the panic condition to propagate and terminate the AUSF service process entirely.

Attack Vector

The attack vector for this vulnerability is network-based and requires no authentication. An attacker can exploit this vulnerability by:

Identifying a free5GC deployment with an exposed AUSF service
Crafting a malicious UE authentication request targeting the /nausf-auth/v1/ue-authentications endpoint
Sending the request with parameters that cause SuciSupiMap to be nil during processing
The AUSF service panics and crashes, denying authentication services to all legitimate users

The vulnerability mechanism involves improper interface handling in Go. When the code attempts to convert an interface value to a concrete type without checking for nil, the Go runtime raises an unrecoverable panic. In a service context without proper panic recovery handlers, this causes process termination.

For technical implementation details, refer to the GitHub Security Advisory and the related GitHub Issue.

Detection Methods for CVE-2026-33063

Indicators of Compromise

AUSF service unexpectedly crashing or restarting repeatedly
Error logs containing "interface conversion: interface {} is nil, not *context.SuciSupiMap"
Go runtime panic stack traces originating from GetSupiFromSuciSupiMap function
Abnormal volume of requests to the /nausf-auth/v1/ue-authentications endpoint

Detection Strategies

Monitor AUSF service health and uptime, alerting on unexpected restarts or crashes
Implement log analysis rules to detect Go panic messages containing nil interface conversion errors
Deploy network intrusion detection signatures for malformed UE authentication requests
Track API endpoint metrics for /nausf-auth/v1/ue-authentications to identify anomalous request patterns

Monitoring Recommendations

Enable process monitoring for the AUSF service with automatic alerting on crashes
Configure centralized logging to capture and analyze Go panic stack traces in real-time
Implement request rate limiting and anomaly detection on the AUSF authentication endpoint
Set up availability monitoring to detect service disruptions indicative of DoS attacks

How to Mitigate CVE-2026-33063

Immediate Actions Required

Upgrade free5GC AUSF to version 1.4.2 or later immediately
Restrict network access to the AUSF API to trusted sources only using firewall rules
Implement API gateway rate limiting to reduce DoS attack impact
Enable service monitoring with automatic restart capabilities as a temporary safeguard

Patch Information

free5GC has released version 1.4.2 of the AUSF component which addresses this vulnerability. The fix implements proper nil checking before the interface conversion in the GetSupiFromSuciSupiMap function.

The patch is available through the following resources:

Organizations should update to AUSF version 1.4.2 or apply the commit 3b9ac4403c2756dc89a5ed3cdcefe688458588aa to address this vulnerability.

Workarounds

Restrict access to the AUSF API endpoint to trusted network sources only using network segmentation
Deploy a reverse proxy or API gateway with strict request validation in front of the AUSF service
Implement network-level access controls to limit exposure of the /nausf-auth/v1/ue-authentications endpoint
Configure container orchestration or systemd to automatically restart the AUSF service upon crash

bash

# Example: Restrict AUSF API access using iptables
# Allow only trusted 5G network functions to access AUSF port
iptables -A INPUT -p tcp --dport 29509 -s 10.5.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 29509 -j DROP