Executive brief
free5gc's Access and Mobility Management Function (AMF) is a core component of 5G networks responsible for managing device connections and authentication. A flaw in how it handles certain types of HTTP requests allows an unauthenticated attacker to crash the AMF service by sending a specially crafted request, causing a complete denial of service to all connected users on that network element.
Technical details
The vulnerability is an unhandled panic in the CreateUEContext handler (HTTPCreateUEContext in api_communication.go) when processing requests with Content-Type: multipart/related. The root cause is improper deserialization in the openapi.MultipartDeserialize function, which attempts an illegal reflection operation (FieldByName on a slice type) when parsing the multipart payload. This causes an unrecoverable panic that crashes the AMF process. The attack requires no authentication and is network-reachable at the SBI endpoint, allowing any attacker with network access to the AMF to trigger a denial of service. A patch addressing the improper deserialization logic is needed to either correctly handle multipart/related content or reject it gracefully.
Affected products
- free5gc free5gc v4.1.0
Timeline
- 2026-01-01: disclosed: Issue reported on GitHub #755
- 2026-08-27: advisory: CVE-2026-30057 published