CVE-2026-44317: free5GC PCF null pointer dereference in app-sessions handler

Executive brief

free5GC is an open-source 5G core network implementation. A vulnerability in its Policy Control Function (PCF) allows an authenticated user to crash the session creation service by sending a specifically crafted request. While the overall system remains running, this specific feature becomes unavailable, potentially disrupting network policy management and session establishment.

Technical details

A NULL pointer dereference (CWE-476) exists in the free5GC PCF 'POST /npcf-policyauthorization/v1/app-sessions' handler. When a request is sent with 'suppFeat' set to '1' (enabling traffic-routing) but lacks the 'AfRoutReq' field in 'medComponents', the 'provisioningOfTrafficRoutingInfo' function attempts to dereference the nil 'routeReq' pointer. This results in a Go runtime panic. Although the Gin framework's recovery middleware prevents a full process crash, it results in an HTTP 500 error and prevents successful session creation. The vulnerability is reachable by any user with a valid OAuth2 access token for the 'npcf-policyauthorization' scope. The issue is fixed in version 1.4.3.

Affected products

• free5GC pcf < 1.4.3

Timeline

• 2026-03-12: other: Vulnerability validated in lab environment
• 2026-05-08: advisory: GitHub Advisory published
• 2026-05-27: other: NVD published CVE-2026-44317

References

• https://api.github.com/users/LinZiyuu
• https://github.com/LinZiyuu
• https://api.github.com/users/LinZiyuu/gists%7B/gist_id%7D
• https://api.github.com/users/LinZiyuu/repos
• https://avatars.githubusercontent.com/u/104151270?v=4
• https://api.github.com/users/LinZiyuu/events%7B/privacy%7D