Executive brief
free5GC is an open-source 5G core network implementation. An improper input validation flaw in the UDM (Unified Data Management) parameter provisioning endpoint allows attackers to send extremely large HTTP requests, causing the service to exhaust memory and crash. This can result in service unavailability for 5G network operations.
Technical details
The HandleUpdate function in udm/internal/sbi/parameter_provision.go reads the entire HTTP request body using c.GetRawData() without enforcing size limits or implementing streaming. An attacker can send a PATCH request to /nudm-pp/v1/imsi-{id}/pp-data with an oversized payload, causing uncontrolled memory allocation that leads to out-of-memory errors and process termination (exit code 137). The vulnerability requires network access to the UDM endpoint, but no authentication bypass is needed if the endpoint is exposed or accessible within the network. A fix would involve implementing request size limits and rejecting requests exceeding a threshold with a 413 Payload Too Large response.
Affected products
- free5gc free5GC v4.0.1
Timeline
- 2026-01-01: disclosed: Issue reported on GitHub
- 2026-08-27: advisory: CVE-2026-30068 published