Executive brief
The Network Exposure Function (NEF) in free5GC, which allows external applications to interact with the 5G core network, contains a flaw that causes the entire service to shut down. An attacker can provide a malformed or unreachable notification address that, when triggered, forces the NEF process to terminate immediately. This results in a complete loss of service availability, preventing external applications from communicating with the mobile core until the system is manually restarted.
Technical details
A denial-of-service vulnerability exists in the free5GC NEF component due to improper error handling in the PFD notification path. In `PfdChangeNotifier.FlushNotifications()`, the application invokes `logger.PFDManageLog.Fatal(err)` upon any delivery failure to a subscriber's `notifyUri`. In Go, the `Fatal` log level triggers an immediate `os.Exit(1)`, bypassing standard middleware recovery mechanisms. An unauthenticated attacker can exploit this by creating a PFD subscription with an unreachable URI and triggering a PFD change, causing the NEF process to crash. This is fixed in version 1.2.3 of the NEF component.
Affected products
- free5GC nef < 1.2.3
Timeline
- 2026-03-20: other: Vulnerability validated in lab environment
- 2026-05-08: advisory
- 2026-05-27: disclosed: NVD publication date