# CVE-2026-44319: free5GC NEF denial of service via unreachable notification URI

Source: https://junglewise.ai/threats/cve-2026-44319-free5gc-nef-denial-of-service-via-unreachable-notification-uri  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-27. Updated: 2026-06-09  
License: CC BY 4.0 with a link back

CVE-2026-44319 · Severity: high · CVSS 7.5 · Published 2026-05-27

The Network Exposure Function (NEF) in free5GC, which allows external applications to interact with the 5G core network, contains a flaw that causes the entire service to shut down. An attacker can provide a malformed or unreachable notification address that, when triggered, forces the NEF process to terminate immediately. This results in a complete loss of service availability, preventing external applications from communicating with the mobile core until the system is manually restarted.

Technologies: [free5GC NEF](https://junglewise.ai/threats/technologies/nef), [github.com/free5gc/nef (Go)](https://junglewise.ai/threats/technologies/github-com-free5gc-nef). Vendors: [free5GC](https://junglewise.ai/threats/vendors/free5gc), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-44319 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44319 being exploited in the wild.

**How severe is CVE-2026-44319?** High severity, with a CVSS score of 7.5, published 27 May 2026.

**Which products and versions are affected?** free5GC NEF < 1.2.3, <= v4.2.1; github.com/free5gc/nef (Go) < 1.2.3, SEMVER:introduced=0,fixed=1.2.3.

**Is there a fix for CVE-2026-44319?** Yes. github.com/free5gc/nef (Go): upgrade to 1.2.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44319 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-44319?** Check whether you run free5GC NEF or github.com/free5gc/nef (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/free5gc/nef (Go): upgrade to 1.2.3 or later

  ```sh
  go get github.com/free5gc/nef@v1.2.3
  ```


## Technical details

A denial-of-service vulnerability exists in the free5GC NEF component due to improper error handling in the PFD notification path. In `PfdChangeNotifier.FlushNotifications()`, the application invokes `logger.PFDManageLog.Fatal(err)` upon any delivery failure to a subscriber's `notifyUri`. In Go, the `Fatal` log level triggers an immediate `os.Exit(1)`, bypassing standard middleware recovery mechanisms. An unauthenticated attacker can exploit this by creating a PFD subscription with an unreachable URI and triggering a PFD change, causing the NEF process to crash. This is fixed in version 1.2.3 of the NEF component.

## Affected products

- free5GC nef < 1.2.3

## Identifiers

- CVE-2026-44319
- GHSA-rxrq-fv76-26pr
- GO-2026-5647

## Timeline

- 2026-03-20: other: Vulnerability validated in lab environment
- 2026-05-08: advisory
- 2026-05-27: disclosed: NVD publication date

## References

- [https://api.github.com/users/LinZiyuu](https://api.github.com/users/LinZiyuu)
- [https://github.com/LinZiyuu](https://github.com/LinZiyuu)
- [https://api.github.com/users/LinZiyuu/gists%7B/gist_id%7D](https://api.github.com/users/LinZiyuu/gists%7B/gist_id%7D)
- [https://api.github.com/users/LinZiyuu/repos](https://api.github.com/users/LinZiyuu/repos)
- [https://avatars.githubusercontent.com/u/104151270?v=4](https://avatars.githubusercontent.com/u/104151270?v=4)
- [https://api.github.com/users/LinZiyuu/events%7B/privacy%7D](https://api.github.com/users/LinZiyuu/events%7B/privacy%7D)

## Related threats

- [free5GC NEF authentication bypass in nnef-pfdmanagement API](https://junglewise.ai/threats/cve-2026-44330-free5gc-nef-authentication-bypass-in-nnef-pfdmanagement-api)
- [free5GC NEF missing authentication in OAM route group](https://junglewise.ai/threats/cve-2026-44327-free5gc-nef-missing-authentication-in-oam-route-group)
- [free5GC NEF missing authentication in 3gpp-traffic-influence API](https://junglewise.ai/threats/cve-2026-44326-free5gc-nef-missing-authentication-in-3gpp-traffic-influence-api)
- [free5GC NEF NULL pointer dereference in PFD management handler](https://junglewise.ai/threats/cve-2026-44322-free5gc-nef-null-pointer-dereference-in-pfd-management-handler)
- [free5GC NEF missing authentication in nnef-callback route group](https://junglewise.ai/threats/cve-2026-44320-free5gc-nef-missing-authentication-in-nnef-callback-route-group)