CVE-2026-53551: free5GC AUSF DoS Vulnerability

CVE-2026-53551 Overview

CVE-2026-53551 is an input validation vulnerability [CWE-20] in free5GC, an open-source implementation of the 5G core network. The flaw resides in the Authentication Server Function (AUSF) component, which fails to validate the supiOrSuci field in User Equipment (UE) authentication requests. Null bytes (\\x00) and other control characters pass through JSON parsing unchanged and reach the Unified Data Management (UDM) function in an unescaped URL path. This causes Go's net/url.Parse() to fail, returning HTTP 500 responses and leaking internal stack traces. An unauthenticated attacker can exploit this at scale to deny authentication service to all subscribers on the affected AUSF.

Critical Impact
Unauthenticated network attackers can trigger denial of service against 5G core authentication, blocking all UE subscribers from authenticating through the affected AUSF instance.

Affected Products

free5GC versions prior to 1.4.5
free5GC AUSF component (Authentication Server Function)
free5GC core network bundle prior to release v4.2.2

Discovery Timeline

2026-07-31 - CVE-2026-53551 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-53551

Vulnerability Analysis

The vulnerability originates in the AUSF ue_authentication.go handler, which processes authentication requests containing a supiOrSuci identifier. The handler accepts the raw JSON-decoded string without validating whether it conforms to a valid SUPI (Subscription Permanent Identifier) or SUCI (Subscription Concealed Identifier) format. JSON parsing in Go preserves embedded null bytes and control characters, allowing attacker-controlled input to survive into downstream processing.

The AUSF then constructs an HTTP request path to the UDM using the tainted identifier. When Go's net/url.Parse() encounters control characters in the URL path, it returns an error. The AUSF handler translates this into an HTTP 500 "System failure" response and includes internal stack trace data in the reply. Repeated malformed requests exhaust the authentication service, denying access to legitimate subscribers.

Root Cause

The root cause is missing input validation on the supiOrSuci field before it is used in URL construction. There is no schema check confirming the field matches the 3GPP-defined format for SUPI or SUCI identifiers. This falls under [CWE-20: Improper Input Validation].

Attack Vector

A remote, unauthenticated attacker sends crafted UE authentication requests containing null bytes or control characters in the supiOrSuci field. Because 5G core signaling interfaces are typically network-reachable within operator infrastructure, and free5GC test environments often expose these interfaces broadly, the attack requires no privileges or user interaction. The attacker only needs the ability to reach the AUSF HTTP endpoint.

	var authInfoReq models.AuthenticationInfoRequest

	supiOrSuci := updateAuthenticationInfo.SupiOrSuci
+	if !validator.IsValidSupi(supiOrSuci) && !validator.IsValidSuci(supiOrSuci) {
+		logger.UeAuthLog.Warnf("invalid supiOrSuci in UE authentication request: %q", supiOrSuci)
+		problemDetails := models.ProblemDetails{
+			Title:  "Malformed request syntax",
+			Status: http.StatusBadRequest,
+			Detail: "supiOrSuci must be a valid SUPI or SUCI",
+			Cause:  "MALFORMED_SUPI_OR_SUCI",
+		}
+		c.Set(sbi.IN_PB_DETAILS_CTX_STR, problemDetails.Cause)
+		c.JSON(http.StatusBadRequest, problemDetails)
+		return
+	}

	snName := updateAuthenticationInfo.ServingNetworkName
	servingNetworkAuthorized := ausf_context.IsServingNetworkAuthorized(snName)

Source: GitHub Commit bfc4a10 — the patch validates the supiOrSuci field using validator.IsValidSupi and validator.IsValidSuci, returning HTTP 400 with a structured ProblemDetails payload when the identifier is malformed.

Detection Methods for CVE-2026-53551

Indicators of Compromise

HTTP 500 "System failure" responses from the AUSF service correlating with authentication request volume spikes.
AUSF log entries containing Go stack traces referencing net/url.Parse errors on UE authentication paths.
Inbound requests to the AUSF /ue-authentications endpoint containing embedded null bytes (\\x00) or ASCII control characters in the supiOrSuci JSON field.

Detection Strategies

Inspect AUSF service logs for repeated URL parsing failures paired with malformed identifier values.
Deploy network-layer inspection on the Service Based Interface (SBI) to flag JSON payloads containing non-printable characters in identity fields.
Correlate a rise in HTTP 5xx responses from AUSF with subscriber authentication failure metrics to detect the DoS condition.

Monitoring Recommendations

Track AUSF request rate, error rate, and latency as baseline SLOs; alert on sudden 5xx surges.
Enable structured logging that captures the supiOrSuci value (redacted) and downstream UDM call status.
Forward AUSF, UDM, and SBI gateway logs to a centralized analytics platform for cross-service correlation of authentication failures.

How to Mitigate CVE-2026-53551

Immediate Actions Required

Upgrade the AUSF component to free5GC AUSF v1.4.5 or upgrade the full stack to free5GC v4.2.2 or later.
Restrict network reachability of AUSF SBI endpoints to trusted 5G core peers only, using network policy or service mesh authorization.
Review AUSF logs for prior exploitation attempts and validate operational stability of the authentication path.

Patch Information

The fix is available in free5GC AUSF v1.4.5 and the bundled free5GC v4.2.2 release. Technical background is documented in the GitHub Security Advisory GHSA-qj55-47fp-p62j and the pull request #61 discussion. The commit adds SUPI/SUCI format validation before the identifier is used in downstream URL construction.

Workarounds

Place a reverse proxy or API gateway in front of the AUSF that rejects JSON payloads containing null bytes or control characters in identity fields.
Apply rate limiting on the AUSF ue-authentications endpoint to reduce the impact of automated malformed-request floods.
Suppress verbose error responses at the ingress layer to prevent stack trace leakage until the patch is deployed.

bash

# Upgrade free5GC AUSF to the patched release
git clone https://github.com/free5gc/ausf.git
cd ausf
git checkout v1.4.5
go build -o ausf cmd/main.go

# Verify version
./ausf -version