Executive brief
free5gc is an open-source 5G core network implementation. The vulnerability allows an attacker to crash the Authentication and Mobility Management Function (AMF) component by sending a specially crafted 5G Registration Request message with an invalid 5GSID Information Element length declaration. This results in complete denial of service for the network's ability to authenticate and manage user equipment connections.
Technical details
The vulnerability is an index-out-of-bounds (panic) in the NAS decoder component of free5gc when parsing the 5GSID Information Element within a 5GMMRegistrationRequest message. The root cause is insufficient length validation during NAS message parsing. An attacker can craft an InitialUEMessage where the 5GSID IE declares a length (L) that does not match the actual content length (e.g., declaring length 5 while content is longer), causing an "index out of range" panic when the parser attempts to read beyond the declared bounds. This panic crashes the AMF process immediately, resulting in complete DoS. The attack requires network reachability to the AMF's NGAP interface but no authentication or user interaction. Patches are available in free5gc versions after v4.0.1.
Affected products
- free5gc free5gc v4.0.1
Timeline
- 2026-01-18: disclosed: Issue reported on GitHub
- 2026-08-27: advisory: CVE published