Executive brief
free5gc is an open-source 5G core network implementation used to test and develop 5G infrastructure. A flaw in the NSSF (Network Slice Selection Function) component allows an attacker to crash the service with a single malformed HTTP request, causing complete service unavailability. This disrupts 5G network slice management and can affect all connected devices.
Technical details
The NssaiAvailabilitySubscriptionCreate request handler in free5gc v4.0.1 contains a nil pointer dereference vulnerability. The handler accesses and mutates a shared global configuration object (factory.NssfConfig.Subscriptions) without initializing it or implementing synchronization, causing a panic when dereferencing uninitialized pointers, maps, or slices. An unauthenticated attacker can trigger this by sending a crafted POST request to the /nnssf-nssaiavailability/v1/nssai-availability/subscriptions endpoint, resulting in a runtime panic (HTTP 500) and immediate service crash. The attack requires no authentication and only network reachability to the NSSF service. A patch or upstream fix is required to add proper initialization and synchronization to the shared state access.
Affected products
- free5gc free5gc v4.0.1
Timeline
- 2026-01-01: disclosed: Vulnerability reported via GitHub issue #764
- 2026-08-27: advisory: CVE-2026-30073 published