CVE-2026-44318: free5GC Race Condition Vulnerability

CVE-2026-44318 Overview

CVE-2026-44318 is a race condition vulnerability [CWE-362] in free5GC, an open-source implementation of the 5G core network. The flaw exists in the Binding Support Function (BSF) PUT /nbsf-management/v1/subscriptions/{subId} handler. The handler reads the global Subscriptions map under RLock() but writes back to the same map without acquiring the mutex. Concurrent authenticated requests can trigger a Go runtime fatal error: concurrent map read and map write. This panic bypasses recover() and terminates the BSF container with exit code 2. Versions prior to 4.2.2 are affected, and the issue is fixed in 4.2.2.

Critical Impact
An authenticated attacker can crash the entire BSF Service-Based Interface (SBI) surface by issuing concurrent PUT requests, taking the function offline until restart.

Affected Products

free5GC versions prior to 4.2.2
free5GC BSF (Binding Support Function) component
5G core network deployments using the affected nbsf-management API

Discovery Timeline

2026-05-27 - CVE-2026-44318 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-44318

Vulnerability Analysis

The vulnerability resides in the BSF subscription handler responsible for managing PCF binding subscriptions in the 5G core. When a PUT request arrives for a subscription identifier, the handler calls BSFContext.GetSubscription(subId), which acquires an RLock() on the global Subscriptions map. If the subscription does not exist, the handler invokes ReplaceIndividualSubcription(), which writes directly to the map using bsfContext.BsfSelf.Subscriptions[subId] = subscription. This write path does not acquire the mutex.

Under concurrent authenticated load, one goroutine can read the map while another writes to it. The Go runtime detects this condition and aborts the process with a fatal error. Unlike conventional panics, runtime map access panics cannot be intercepted by recover(), so the BSF container exits with code 2.

Root Cause

The root cause is an unsynchronized write to a shared global map. The read path uses an RLock(), but the corresponding write path omits any locking. This inconsistent locking discipline violates Go's concurrency safety requirements for maps and constitutes a classic race condition [CWE-362].

Attack Vector

An authenticated client with access to the BSF SBI can issue concurrent PUT requests against /nbsf-management/v1/subscriptions/{subId} using a non-existent subscription identifier. Parallel requests cause overlapping read and write access to the global map, triggering the Go runtime abort. The attacker does not require elevated privileges beyond standard authenticated SBI access.

The vulnerability is described in prose because no public proof-of-concept code has been released. See the GitHub Security Advisory GHSA-27ph-8q4f-h7m7 for technical details.

Detection Methods for CVE-2026-44318

Indicators of Compromise

BSF container exits with code 2 and restarts unexpectedly in orchestrator logs.
Go runtime fatal error message fatal error: concurrent map read and map write in BSF stderr or container logs.
Bursts of concurrent PUT requests to /nbsf-management/v1/subscriptions/{subId} targeting the same or non-existent subscription IDs.

Detection Strategies

Monitor BSF process restart counts and exit codes through Kubernetes or container runtime metrics.
Inspect application logs for Go runtime panics referencing concurrent map access in bsfContext or ReplaceIndividualSubcription.
Correlate SBI access logs to identify clients generating high-rate parallel PUT subscription requests.

Monitoring Recommendations

Alert on repeated BSF pod restarts within short time windows in the 5G core control plane.
Track per-client request rates against the nbsf-management API and flag anomalous concurrency.
Forward BSF stdout and stderr to a centralized logging platform to capture runtime panic traces.

How to Mitigate CVE-2026-44318

Immediate Actions Required

Upgrade free5GC to version 4.2.2 or later, which contains the synchronization fix.
Restrict access to the BSF SBI endpoints to trusted network functions within the 5G core.
Apply rate limiting on the nbsf-management API to reduce the likelihood of triggering the race window.

Patch Information

The fix is available in free5GC 4.2.2. The upstream patch is published in the free5gc/bsf commit 27790856 and merged via Pull Request #7. Tracking is available in Issue #926.

Workarounds

Place the BSF behind an authenticating reverse proxy that serializes or rate-limits PUT requests to /nbsf-management/v1/subscriptions/{subId}.
Configure container orchestration to automatically restart the BSF on exit code 2 while patches are being deployed.
Limit network reachability of the BSF SBI to known PCF and consumer NFs through service mesh policies or network ACLs.

bash

# Upgrade free5GC to the patched release
git clone https://github.com/free5gc/free5gc.git
cd free5gc
git checkout v4.2.2
make all