Executive brief
free5GC is an open-source implementation of 5G core network functions. A NULL pointer dereference in the User Data Management (UDM) component's 3GPP access registration handler allows attackers to crash the service by sending incomplete or malformed registration requests, causing service downtime.
Technical details
A NULL pointer dereference vulnerability exists in the RegistrationAmf3gppAccessProcedure function within the UDMC registration handler. The vulnerable code assumes required nested fields are present in the Amf3GppAccessRegistration payload and dereferences them without validation checks. An unauthenticated attacker can send a crafted HTTP PUT request with an incomplete JSON body to the /nudm-uecm/v1/{IMSI}/registrations/amf-3gpp-access endpoint, triggering a panic that crashes the UDM service. The vulnerability requires network access to the UDM service endpoint but no authentication. The impact is denial of service; patched versions should validate all required fields before dereferencing.
Affected products
- free5GC free5GC v4.0.1
Timeline
- 2026-01-01: disclosed: Bug report opened on GitHub
- 2026-08-27: advisory: CVE-2026-30069 published