Executive brief
free5gc is an open-source 5G core network implementation. The AMF (Access and Mobility Management Function) component contains a denial-of-service vulnerability in its event subscription modification handler that allows remote attackers to crash the service by sending a specially crafted API request with an invalid path parameter.
Technical details
The vulnerability is an improper input validation flaw in the ModifyAMFEventSubscriptionProcedure function within the HTTPModifySubscription handler. The code attempts to slice a JSON Patch path string at a fixed position (characters 11 onwards) without first validating that the path is at least 11 characters long. When a PATCH request is sent with a path shorter than 11 characters (e.g., "/a"), the slice operation causes a runtime panic ("slice bounds out of range"), crashing the AMF process. The vulnerability is reachable over the network via the /namf-evts/v1/subscriptions endpoint without requiring authentication. An attacker can repeatedly trigger this crash to cause a denial of service, preventing legitimate 5G network operations.
Affected products
- free5gc free5gc v4.0.1
Timeline
- 2026-01-01: disclosed: Issue opened on GitHub
- 2026-08-27: advisory: CVE-2026-30058 published