Executive brief
free5gc is an open-source 5G Core Network implementation used for research and telecommunications deployments. The AMF (Access and Mobility Management Function) component crashes when receiving a specially crafted request that omits or empties the RestrictedRatList field, causing service interruption and potential network unavailability for connected users.
Technical details
A missing bounds check in the CreateUEContextProcedure function (/namf-comm/v1/ue-contexts/{supi} endpoint) causes an out-of-bounds array access panic. The vulnerable code attempts to read ueContextCreateData.UeContext.RestrictedRatList[0] without verifying the array contains elements. An unauthenticated attacker can send a PUT request with an empty or omitted RestrictedRatList field, triggering a runtime panic that crashes the AMF process. The attack requires network access to the AMF service port (typically 8000) but does not require authentication. Fix: upgrade to patched version or validate RestrictedRatList length before indexing.
Affected products
- free5gc free5gc v4.1.0
Timeline
- 2026-01-06: disclosed
- 2026-08-27: advisory