CVE-2026-44318: free5GC BSF denial of service via concurrent map access

Executive brief

A vulnerability in the free5GC Binding Selection Function (BSF) allows an authenticated user to crash the service by sending specific concurrent requests. The BSF is a critical component in 5G core networks used for discovering session management policies. An exploit results in a complete denial of service, preventing other network functions from looking up session bindings until the system is manually restarted.

Technical details

A race condition (CWE-362) exists in the free5GC BSF component due to missing synchronization (CWE-820) when handling PUT requests to the nbsf-management subscription endpoint. While most map operations are protected by a mutex, the 'create-if-absent' logic in the ReplaceIndividualSubcription function performs an unsynchronized write to the global Subscriptions map. When multiple concurrent requests are processed, the Go runtime detects a simultaneous read and write, triggering an unrecoverable fatal error that terminates the process. This bypasses standard middleware recovery mechanisms. Exploitation requires a valid OAuth2 access token. The issue is fixed in version 1.0.2.

Affected products

• free5GC bsf < 1.0.2

Timeline

• 2026-03-22: other: Vulnerability validated in lab environment
• 2026-05-07: disclosed
• 2026-05-08: advisory
• 2026-05-27: other: NVD published

References

• https://api.github.com/users/LinZiyuu
• https://github.com/LinZiyuu
• https://api.github.com/users/LinZiyuu/gists%7B/gist_id%7D
• https://api.github.com/users/LinZiyuu/repos
• https://avatars.githubusercontent.com/u/104151270?v=4
• https://api.github.com/users/LinZiyuu/events%7B/privacy%7D