Executive brief
free5gc is an open-source 5G core network implementation used to build telecommunications infrastructure. The NF Discovery endpoint, which is responsible for locating network functions in a 5G network, crashes when receiving a crafted request with an empty snssais query parameter. An attacker can exploit this to cause a denial of service, disrupting network connectivity and communication services for affected deployments.
Technical details
The vulnerability is a runtime panic triggered by improper bounds checking in the NF Discovery endpoint handler. Specifically, in internal/sbi/processor/nf_discovery.go around line 346, the code performs a string slice operation on the snssais query parameter without first validating that the string is long enough, causing a "slice bounds out of range" panic when snssais is empty or malformed. The attack vector is network-based and requires no authentication—any attacker with network access to the NRF service port can send a crafted HTTP GET request to the /nnrf-disc/v1/nf-instances endpoint with an empty snssais parameter to trigger the crash and deny service to legitimate users. The vulnerability affects free5gc v4.0.1 and likely earlier versions with the same vulnerable code path.
Affected products
- free5gc free5gc v4.0.1
Timeline
- 2026-01-01: disclosed: Issue #758 opened on GitHub
- 2026-08-27: advisory: CVE-2026-30063 published