Is CVE-2026-44317 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-44317 being exploited in the wild.

How severe is CVE-2026-44317?

Medium severity, with a CVSS score of 6.5, published 27 May 2026.

Which products and versions are affected?

free5GC PCF < 1.4.3, < 4.2.2; github.com/free5gc/pcf (Go) < 1.4.3, SEMVER:introduced=0,fixed=1.4.3.

Is there a fix for CVE-2026-44317?

Yes. github.com/free5gc/pcf (Go): upgrade to 1.4.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-44317 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-44317?

Check whether you run free5GC PCF or github.com/free5gc/pcf (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44317: free5GC PCF null pointer dereference in app-sessions handler

Q: Which products and versions are affected?

free5GC PCF < 1.4.3, < 4.2.2; github.com/free5gc/pcf (Go) < 1.4.3, SEMVER:introduced=0,fixed=1.4.3.

Q: Is there a fix for CVE-2026-44317?

Yes. github.com/free5gc/pcf (Go): upgrade to 1.4.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-44317 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-44317?

Check whether you run free5GC PCF or github.com/free5gc/pcf (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44317 · Severity: medium · CVSS 6.5 · Published 2026-05-27

free5GC is an open-source 5G core network implementation. A vulnerability in its Policy Control Function (PCF) allows an authenticated user to crash the session creation service by sending a specifically crafted request. While the overall system remains running, this specific feature becomes unavailable, potentially disrupting network policy management and session establishment.

Technologies: free5GC PCF, github.com/free5gc/pcf (Go). Vendors: free5GC, Go.

Quick answers

Is CVE-2026-44317 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-44317 being exploited in the wild.
How severe is CVE-2026-44317?: Medium severity, with a CVSS score of 6.5, published 27 May 2026.
Which products and versions are affected?: free5GC PCF < 1.4.3, < 4.2.2; github.com/free5gc/pcf (Go) < 1.4.3, SEMVER:introduced=0,fixed=1.4.3.
Is there a fix for CVE-2026-44317?: Yes. github.com/free5gc/pcf (Go): upgrade to 1.4.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44317 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-44317?: Check whether you run free5GC PCF or github.com/free5gc/pcf (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/free5gc/pcf (Go): upgrade to 1.4.3 or later
```
go get github.com/free5gc/pcf@v1.4.3
```

Technical details

A NULL pointer dereference (CWE-476) exists in the free5GC PCF 'POST /npcf-policyauthorization/v1/app-sessions' handler. When a request is sent with 'suppFeat' set to '1' (enabling traffic-routing) but lacks the 'AfRoutReq' field in 'medComponents', the 'provisioningOfTrafficRoutingInfo' function attempts to dereference the nil 'routeReq' pointer. This results in a Go runtime panic. Although the Gin framework's recovery middleware prevents a full process crash, it results in an HTTP 500 error and prevents successful session creation. The vulnerability is reachable by any user with a valid OAuth2 access token for the 'npcf-policyauthorization' scope. The issue is fixed in version 1.4.3.

Affected products

free5GC pcf < 1.4.3

Identifiers

CVE-2026-44317
GHSA-wwqh-7jm5-gj7w
GO-2026-5731

Timeline

2026-03-12: other: Vulnerability validated in lab environment
2026-05-08: advisory: GitHub Advisory published
2026-05-27: other: NVD published CVE-2026-44317

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.