Is CVE-2026-44316 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-44316 being exploited in the wild.

How severe is CVE-2026-44316?

High severity, with a CVSS score of 7.5, published 27 May 2026.

Which products and versions are affected?

free5GC PCF < 1.4.2, <= 4.2.1; github.com/free5gc/pcf (Go) < 1.4.2, SEMVER:introduced=0,fixed=1.4.2.

Is there a fix for CVE-2026-44316?

Yes. github.com/free5gc/pcf (Go): upgrade to 1.4.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-44316 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-44316?

Check whether you run free5GC PCF or github.com/free5gc/pcf (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44316: free5GC PCF NULL pointer dereference in HandleCreateSmPolicyRequest

Q: Which products and versions are affected?

free5GC PCF < 1.4.2, <= 4.2.1; github.com/free5gc/pcf (Go) < 1.4.2, SEMVER:introduced=0,fixed=1.4.2.

Q: Is there a fix for CVE-2026-44316?

Yes. github.com/free5gc/pcf (Go): upgrade to 1.4.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-44316 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-44316?

Check whether you run free5GC PCF or github.com/free5gc/pcf (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44316 · Severity: high · CVSS 7.5 · Published 2026-05-27

A vulnerability in the free5GC Policy Control Function (PCF) allows an attacker to cause a service error by sending a specially crafted request. The PCF is a core component of 5G networks responsible for policy rules. While the system remains running, specific requests will fail with an internal server error, potentially disrupting network policy operations for affected users.

Technologies: free5GC PCF, github.com/free5gc/pcf (Go). Vendors: free5GC, Go.

Quick answers

Is CVE-2026-44316 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-44316 being exploited in the wild.
How severe is CVE-2026-44316?: High severity, with a CVSS score of 7.5, published 27 May 2026.
Which products and versions are affected?: free5GC PCF < 1.4.2, <= 4.2.1; github.com/free5gc/pcf (Go) < 1.4.2, SEMVER:introduced=0,fixed=1.4.2.
Is there a fix for CVE-2026-44316?: Yes. github.com/free5gc/pcf (Go): upgrade to 1.4.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44316 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-44316?: Check whether you run free5GC PCF or github.com/free5gc/pcf (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/free5gc/pcf (Go): upgrade to 1.4.2 or later
```
go get github.com/free5gc/pcf@v1.4.2
```

Technical details

A NULL pointer dereference (CWE-476) exists in the HandleCreateSmPolicyRequest function within free5GC's PCF. When a POST request to /npcf-smpolicycontrol/v1/sm-policies triggers a downstream UDR lookup that returns a 404 Not Found, the handler logs the error but fails to exit. It subsequently attempts to dereference a nil response struct, causing a panic. While the Gin recovery middleware prevents a full process crash, the request results in an HTTP 500 error. This endpoint is reachable without authentication in affected versions due to a missing authorization middleware. The issue is fixed in version 1.4.2.

Affected products

free5gc pcf < 1.4.2

Identifiers

CVE-2026-44316
GHSA-wr8j-6chw-gm6p
GO-2026-5720

Timeline

2026-05-07: disclosed
2026-05-08: advisory: GitHub Advisory GHSA-wr8j-6chw-gm6p published
2026-05-27: kev added: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.