Executive brief
A vulnerability in the Session Management Function (SMF) of the free5GC 5G core network allows an unauthenticated attacker to crash the service. By sending a specially crafted request to a management endpoint that lacks proper security checks, an attacker can force the entire SMF process to terminate. This results in a complete denial of service, preventing the mobile network from establishing or managing user data sessions until the system is manually restarted.
Technical details
The free5GC Session Management Function (SMF) fails to apply OAuth2 authentication/authorization middleware to the 'UPI' management route group (CWE-306, CWE-862). The 'POST /upi/v1/upNodesLinks' handler passes attacker-controlled JSON to 'UpNodesFromConfiguration()', which performs validation using 'logger.InitLog.Fatalf()'. Because 'Fatalf' in Go's standard logger (or equivalent wrappers) typically calls 'os.Exit(1)', a validation failure—such as providing a UE IP pool that overlaps with an existing one—terminates the entire SMF process rather than just the request goroutine. This allows a remote, unauthenticated attacker to cause a persistent denial of service by repeatedly crashing the SMF. A fix is available in the upstream SMF repository.
Affected products
- free5gc smf <= 1.4.3
Timeline
- 2026-03-22: other: Vulnerability validated in lab environment
- 2026-05-07: disclosed: Advisory published to free5gc/free5gc repository
- 2026-05-08: advisory: GitHub Advisory GHSA-44qj-cghf-9p97 published