Executive brief
free5gc is an open-source 5G core network implementation that provides services for network device discovery. The NRF Discovery service contains a flaw in input validation that allows an attacker to crash the service with a specially crafted request, disrupting network operations and availability of critical 5G infrastructure components.
Technical details
The vulnerability exists in the complexQueryFilterSubprocess function within the NRF Discovery service (nf_discovery.go:1556). The code splits the "tai" parameter by commas and directly accesses array indices [0] and [1] without validating that the split operation produces at least two elements. When a malformed tai parameter is provided (e.g., containing fewer than two comma-separated values), accessing taiSplit[1] triggers an index out of range panic, causing the handler to crash. This is a classic input validation flaw affecting a network-reachable API endpoint; no authentication is required. The attack can be exploited remotely by sending a specially crafted GET request to the NF discovery endpoint with a malformed complexQuery parameter, causing denial of service.
Affected products
- free5gc free5gc v4.0.1
Timeline
- 2026-01-06: disclosed
- 2026-08-27: advisory