CVE-2026-44328: free5GC SMF DoS Vulnerability

CVE-2026-44328 Overview

CVE-2026-44328 is a high-severity vulnerability in free5GC, an open-source implementation of the 5G core network. The Session Management Function (SMF) mounts the User Plane Information (UPI) management route group without inbound OAuth2 middleware. A single unauthenticated DELETE /upi/v1/upNodesLinks/{upNodeRef} request triggers a nil-pointer panic and mutates in-memory user-plane topology before crashing. The flaw is tracked under CWE-306: Missing Authentication for Critical Function and is fixed in version 4.2.2.

Critical Impact
An off-path network attacker can crash the SMF process and corrupt user-plane topology state by sending a single unauthenticated HTTP DELETE request targeting any Access Network (AN) entry by name.

Affected Products

free5GC versions prior to 4.2.2
free5GC SMF (Session Management Function) component
5G core network deployments using the vulnerable UPI management route

Discovery Timeline

2026-05-27 - CVE-2026-44328 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-44328

Vulnerability Analysis

The vulnerability resides in the SMF's UPI management route group. The route group is mounted without OAuth2 middleware, exposing administrative endpoints to unauthenticated callers on the network. The DELETE /upi/v1/upNodesLinks/{upNodeRef} handler unconditionally dereferences upNode.UPF after a type-guarded asynchronous release path. AN-typed nodes are constructed without a UPF object, so dereferencing this field produces a nil-pointer panic. Before panicking, the handler executes UpNodeDelete(upNodeRef), mutating the in-memory user-plane topology. This combination yields both denial of service and state corruption from a single request. See the GitHub Security Advisory GHSA-p9mg-74mg-cwwr for advisory details.

Root Cause

The defect has two root causes. First, the UPI management route group lacks inbound OAuth2 authentication middleware, violating the principle of authenticating administrative endpoints. Second, the DELETE handler omits a type check before dereferencing the UPF pointer on node objects, despite AN-typed nodes being constructed without that field populated.

Attack Vector

The attack is performed over the network with low complexity and no privileges. An attacker who can reach the SMF management interface sends an HTTP DELETE request naming any known or guessable AN entry. The request executes the topology deletion routine before the process crashes. Repeated requests sustain the denial-of-service condition and progressively corrupt user-plane state. Review the GitHub commit b57bc48081c3d3a2f333d02eb78e4fd31a120deb and pull request #199 for the exact code paths involved.

Detection Methods for CVE-2026-44328

Indicators of Compromise

Unexpected SMF process crashes accompanied by Go runtime nil-pointer dereference stack traces referencing the UPI handler.
HTTP DELETE requests targeting /upi/v1/upNodesLinks/ endpoints originating from unauthenticated or unexpected sources.
Missing or inconsistent entries in the SMF user-plane topology after restart, particularly for AN-typed nodes such as gNB1.

Detection Strategies

Inspect SMF access logs for DELETE requests against /upi/v1/upNodesLinks/{upNodeRef} and correlate with process restart events.
Alert on repeated SMF panics or container restarts within the 5G core control plane within short time windows.
Compare runtime user-plane topology state against the declared configuration to identify unauthorized mutations.

Monitoring Recommendations

Forward SMF stdout, stderr, and crash logs to a centralized logging pipeline with retention for forensic review.
Enable network flow telemetry on the SMF management interface to identify unauthenticated administrative API access.
Monitor service availability metrics for the SMF, including request error rates and process uptime, and trigger alerts on regression.

How to Mitigate CVE-2026-44328

Immediate Actions Required

Upgrade free5GC to version 4.2.2 or later, which contains the fix for both the missing authentication and the nil-pointer dereference.
Restrict network reachability to the SMF UPI management endpoints using firewall rules or network policies so only trusted operators can reach them.
Audit existing user-plane topology against intended configuration and rebuild any AN nodes that may have been deleted by exploitation attempts.

Patch Information

The maintainers released the fix in free5GC 4.2.2. The corrective changes are tracked in GitHub issue #905, pull request #199, and commit b57bc48081c3d3a2f333d02eb78e4fd31a120deb. Operators should rebuild SMF container images from the patched source and redeploy across all 5G core environments.

Workarounds

Place the SMF management API behind a reverse proxy or API gateway that enforces OAuth2 or mutual TLS authentication on all /upi/v1/ routes.
Apply Kubernetes NetworkPolicy or equivalent segmentation to permit only operator subnets to reach the SMF management port until the patch is applied.
Disable or block the DELETE /upi/v1/upNodesLinks/ route at an upstream proxy if topology mutations are not required during operation.

bash

# Configuration example
# Block external access to the SMF UPI management routes pending upgrade to 4.2.2
iptables -A INPUT -p tcp --dport 8000 -m string --string "/upi/v1/upNodesLinks" --algo bm -j DROP

# Upgrade free5GC SMF to the patched version
git clone https://github.com/free5gc/free5gc.git
cd free5gc
git checkout v4.2.2
make all