CVE-2026-44316: free5GC PCF NULL pointer dereference in HandleCreateSmPolicyRequest

Executive brief

A vulnerability in the free5GC Policy Control Function (PCF) allows an attacker to cause a service error by sending a specially crafted request. The PCF is a core component of 5G networks responsible for policy rules. While the system remains running, specific requests will fail with an internal server error, potentially disrupting network policy operations for affected users.

Technical details

A NULL pointer dereference (CWE-476) exists in the HandleCreateSmPolicyRequest function within free5GC's PCF. When a POST request to /npcf-smpolicycontrol/v1/sm-policies triggers a downstream UDR lookup that returns a 404 Not Found, the handler logs the error but fails to exit. It subsequently attempts to dereference a nil response struct, causing a panic. While the Gin recovery middleware prevents a full process crash, the request results in an HTTP 500 error. This endpoint is reachable without authentication in affected versions due to a missing authorization middleware. The issue is fixed in version 1.4.2.

Affected products

• free5gc pcf < 1.4.2

Timeline

• 2026-05-07: disclosed
• 2026-05-08: advisory: GitHub Advisory GHSA-wr8j-6chw-gm6p published
• 2026-05-27: kev added: NVD publication date

References

• https://api.github.com/users/LinZiyuu
• https://github.com/LinZiyuu
• https://api.github.com/users/LinZiyuu/gists%7B/gist_id%7D
• https://api.github.com/users/LinZiyuu/repos
• https://avatars.githubusercontent.com/u/104151270?v=4
• https://api.github.com/users/LinZiyuu/events%7B/privacy%7D