Executive brief
free5gc is an open-source 5G network core implementation. A bug in the OAuth2 token endpoint causes the service to crash when a POST request contains an unknown form parameter, rendering the authentication system unavailable until the service is restarted.
Technical details
The vulnerability is an improper input validation flaw in the OAuth2 token handler (processor/processor.go, specifically the buildFilter function or HTTPAccessTokenRequest handler). When processing form data from POST requests to /oauth2/token, the code iterates through all key-value pairs and attempts to map them to struct fields using YAML tags. For unmatched form keys, the code leaves the field name as an empty string and attempts to set a value via reflect.FieldByName(""), which returns a zero reflect.Value. Calling .Set() on this zero value triggers a panic that crashes the goroutine. The attack requires only network access to the /oauth2/token endpoint and no authentication; a single malformed request can terminate the NRF (Network Repository Function) process, causing denial of service.
Affected products
- free5gc free5gc v4.0.1
Timeline
- 2026-01-06: disclosed: Issue #770 opened on GitHub
- 2026-08-27: advisory: CVE-2026-30064 published