Executive brief
free5gc is an open-source 5G core network implementation used in mobile network deployments. The Access and Mobility Management Function (AMF) component can be crashed remotely when it receives a malformed network message containing an invalid NAS Protocol Data Unit (PDU). An attacker with network access to the 5G core can cause service unavailability by sending a specially crafted message that triggers an unhandled crash, disrupting mobile network operations.
Technical details
The vulnerability is an unvalidated input issue in the NGAP handler's NAS PDU processing layer. When the AMF receives an InitialUEMessage containing a malformed NAS PDU (e.g., a single byte instead of a properly formed message), the nas.GetSecurityHeaderType() function attempts to access an array index that exceeds the actual data length, causing a panic and immediate process termination. The attack requires network connectivity to the NGAP interface (SCTP port) and no authentication. The vulnerability affects free5gc v4.0.1 and likely earlier versions; patches addressing input validation should be available in newer versions.
Affected products
- free5gc free5gc v4.0.1
Timeline
- 2026-01-18: disclosed: Issue reported on GitHub
- 2026-08-27: advisory: CVE-2026-30062 published