CVE-2026-44319: free5GC NEF Denial of Service Vulnerability

CVE-2026-44319 Overview

CVE-2026-44319 is a denial-of-service vulnerability in free5GC, an open-source implementation of the 5G core network. The flaw resides in the Network Exposure Function (NEF) component, specifically in the Packet Flow Description (PFD) change notification logic. An unauthenticated attacker can create a PFD subscription with an attacker-controlled notifyUri and trigger a PFD change, causing the NEF process to terminate. The defect affects free5GC versions prior to 4.2.2 and is fixed in version 4.2.2.

Critical Impact
Remote attackers can deterministically crash the NEF process, dropping the entire Service-Based Interface (SBI) surface until manual restart.

Affected Products

free5GC versions prior to 4.2.2
free5GC NEF component (nef module)
5G core deployments exposing NEF PFD management APIs

Discovery Timeline

2026-05-27 - CVE-2026-44319 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-44319

Vulnerability Analysis

The vulnerability is an improper input validation issue ([CWE-20]) combined with unsafe error handling in the NEF's PFD change notifier. When the NEF needs to inform a subscribed Application Function (AF) of a PFD update, it calls PfdChangeNotifier.FlushNotifications(), which in turn invokes NnefPFDmanagementNotify(...) to deliver the notification to the subscriber's notifyUri. If the HTTP delivery fails for any reason, the code calls logger.PFDManageLog.Fatal(err).

In Go, logger.Fatal is equivalent to os.Exit(1). The runtime bypasses deferred cleanup and terminates the entire process. Because notification delivery happens asynchronously, an attacker only needs to influence the destination URL to weaponize a transient network error into a guaranteed process kill.

Root Cause

The root cause is treating a recoverable, attacker-influenced network error as a fatal condition. The NEF accepts subscriber-supplied notifyUri values without restricting them to reachable, authenticated endpoints, and the notification loop lacks per-subscriber error isolation. A single failed callback aborts the entire daemon instead of logging the error and continuing.

Attack Vector

An attacker reachable on the SBI network creates a PFD subscription that sets notifyUri to an unreachable host, a closed port, or an endpoint that returns an error. The attacker then triggers a PFD change event. The NEF attempts asynchronous delivery, the request fails, and Fatal(err) exits the process with status 1. Recovery requires manual or orchestrated restart of the NEF service. The vulnerability does not require authentication, privileges, or user interaction.

No verified public proof-of-concept code is available. See the GitHub Security Advisory and the GitHub Issue Discussion for technical details.

Detection Methods for CVE-2026-44319

Indicators of Compromise

NEF process exits with status code 1 shortly after PFD-related notification activity.
Log entries from PFDManageLog containing Fatal messages immediately preceding process termination.
Repeated PFD subscription creations from the same client referencing unreachable or external notifyUri values.
Sudden loss of NEF SBI availability while other 5G core network functions remain healthy.

Detection Strategies

Monitor NEF container or systemd unit restart counts and alert on abnormal exit codes.
Inspect NEF audit logs for PFD subscription requests with notifyUri values pointing outside the trusted SBI network range.
Correlate PFD change events with subsequent NEF crashes to identify causal patterns indicating exploitation.

Monitoring Recommendations

Track 5G core SBI health endpoints to detect NEF unavailability in near real time.
Capture and centralize free5GC structured logs into a SIEM for retrospective analysis of Fatal events.
Enable network flow logging between NEF and AF endpoints to verify destinations of outbound PFD notifications.

How to Mitigate CVE-2026-44319

Immediate Actions Required

Upgrade free5GC to version 4.2.2 or later, which removes the fatal exit on notification failure.
Restrict NEF API exposure so that only trusted AFs on segmented networks can create PFD subscriptions.
Validate and allowlist acceptable notifyUri destinations at an ingress proxy or API gateway in front of NEF.

Patch Information

The vulnerability is fixed in free5GC 4.2.2. The upstream fix is published in the GitHub Commit Update and reviewed in the GitHub Pull Request. The patch replaces the Fatal call in PfdChangeNotifier.FlushNotifications() with non-terminating error logging, preserving NEF availability when subscriber callbacks fail.

Workarounds

Run NEF under a supervisor such as systemd or Kubernetes with an aggressive restart policy to reduce downtime windows.
Enforce mutual TLS and strict authorization on PFD subscription endpoints to limit which clients can register notifyUri values.
Place an egress filter between NEF and AF networks to block notifications destined for non-approved hosts, reducing exploit reliability.

bash

# Configuration example: upgrade free5GC NEF to the patched version
git clone https://github.com/free5gc/free5gc.git
cd free5gc
git checkout v4.2.2
make nef