# CVE-2026-30056: free5gc AMF NGAP Dispatcher NULL pointer dereference

Source: https://junglewise.ai/threats/cve-2026-30056-free5gc-amf-ngap-dispatcher-null-pointer-dereference  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-27. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-30056 · Severity: high · CVSS 7.5 · Published 2026-08-27

free5gc is an open-source 5G core network implementation. An attacker can crash the AMF (Access and Mobility Management Function) component by sending specially crafted NGAP protocol messages in an incorrect sequence, causing service disruption for legitimate mobile subscribers. This NULL pointer dereference requires network access to the AMF but no authentication, making it a straightforward denial-of-service attack vector.

Technologies: [free5GC](https://junglewise.ai/threats/technologies/free5gc). Vendors: [free5GC](https://junglewise.ai/threats/vendors/free5gc).

## Quick answers

**Is CVE-2026-30056 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-30056 being exploited in the wild.

**How severe is CVE-2026-30056?** High severity, with a CVSS score of 7.5, published 27 August 2026.

**Which products and versions are affected?** free5GC v4.0.1.

**Is there a fix for CVE-2026-30056?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-30056 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-30056?** Check whether you run free5GC at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A NULL pointer dereference exists in the AMF NGAP Dispatcher when it fails to validate the mandatory message sequence during RAN connection initialization. The dispatcher creates an AmfRan context for any incoming NGAP message on a new SCTP connection, bypassing the requirement that the first message must be NGSetupRequest. If a subsequent message (e.g., UEContextReleaseComplete) arrives before the registration flow completes, the handler attempts to dereference an uninitialized UE context pointer, triggering a panic. An attacker with network access to the AMF can exploit this via crafted NGAP messages on a new SCTP connection; no prior authentication or user interaction is required. This causes repeated AMF process crashes and service denial to legitimate users. Patches addressing the message sequence validation are available in later versions of free5gc.

## Affected products

- free5gc free5gc v4.0.1

## Timeline

- 2026-01-05: disclosed: GitHub issue #768 opened
- 2026-08-27: advisory: NVD advisory published

## References

- [https://github.com/free5gc/free5gc/issues/768](https://github.com/free5gc/free5gc/issues/768)

## Related threats

- [Free5GC SMF resource exhaustion in PFCP session establishment](https://junglewise.ai/threats/cve-2026-106805-a-resource-exhaustion-issue-exists-in-free5gc-v4-2-3-during-pfcp)
- [Free5GC race condition in GMM handler RanUe context access](https://junglewise.ai/threats/cve-2026-94043-a-vulnerability-was-determined-in-free5gc-up-to-4-2-3-this)
- [Free5GC UPF nil pointer dereference in PFCP Session Report](https://junglewise.ai/threats/cve-2026-75439-free5gc-upf-nil-pointer-dereference-in-pfcp-session-report)
- [free5GC NRF input validation bypass in NF profile registration](https://junglewise.ai/threats/cve-2026-55068-free5gc-nrf-input-validation-bypass-in-nf-profile-registration)
- [free5gc NSSF nil pointer dereference in NssaiAvailabilitySubscriptionCreate](https://junglewise.ai/threats/cve-2026-30073-free5gc-nssf-nil-pointer-dereference-in)