Executive brief
free5gc is an open-source implementation of a 5G core network. The Charging Handling Function (CHF) component processes billing data from other network functions. A NULL pointer dereference vulnerability in the CDR (Charge Detail Record) processing path allows an attacker to crash the CHF service by sending a malformed charging request, disrupting billing operations and network service availability.
Technical details
The vulnerability is a NULL pointer dereference in the OpenCDR function within internal/sbi/processor/cdr.go of free5gc v4.0.1. The code assumes the nested field pDUSessionChargingInformation.pduSessionInformation is non-nil and directly accesses PduSessionInformation.PduSessionID without prior validation. When a client omits the pduSessionInformation field in a POST request to /nchf-convergedcharging/v3/chargingdata, the code dereferences a nil pointer, causing a runtime panic. The vulnerability is network-reachable and requires no authentication; an attacker can trigger it by sending a crafted JSON payload via HTTP POST. The impact is Denial of Service—the CHF process crashes and returns HTTP 500 or drops the connection, halting billing functions.
Affected products
- free5gc CHF (Charging Handling Function) v4.0.1
Timeline
- 2026-01-01: disclosed: Issue reported on GitHub
- 2026-08-27: advisory: CVE-2026-30072 published