Quick answers
- Is CVE-2026-30063 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-30063 being exploited in the wild.
- How severe is CVE-2026-30063?
- High severity, with a CVSS score of 7.5, published 27 August 2026.
- Which products and versions are affected?
- free5GC v4.0.1.
- Is there a fix for CVE-2026-30063?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-30063 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-30063?
- Check whether you run free5GC at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a runtime panic triggered by improper bounds checking in the NF Discovery endpoint handler. Specifically, in internal/sbi/processor/nf_discovery.go around line 346, the code performs a string slice operation on the snssais query parameter without first validating that the string is long enough, causing a "slice bounds out of range" panic when snssais is empty or malformed. The attack vector is network-based and requires no authentication—any attacker with network access to the NRF service port can send a crafted HTTP GET request to the /nnrf-disc/v1/nf-instances endpoint with an empty snssais parameter to trigger the crash and deny service to legitimate users. The vulnerability affects free5gc v4.0.1 and likely earlier versions with the same vulnerable code path.
Affected products
- free5gc free5gc v4.0.1
Timeline
- 2026-01-01: disclosed: Issue #758 opened on GitHub
- 2026-08-27: advisory: CVE-2026-30063 published