Is CVE-2026-44321 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-44321 being exploited in the wild.

How severe is CVE-2026-44321?

High severity, with a CVSS score of 7.5, published 27 May 2026.

Which products and versions are affected?

free5GC Smf < 4.2.2, <= 1.4.3; github.com/free5gc/smf (Go) <= 1.4.3, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.4.3.

Is there a fix for CVE-2026-44321?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-44321 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-44321?

Check whether you run free5GC Smf or github.com/free5gc/smf (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44321: free5GC SMF unauthenticated denial of service in UPI management

Q: Which products and versions are affected?

free5GC Smf < 4.2.2, <= 1.4.3; github.com/free5gc/smf (Go) <= 1.4.3, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.4.3.

Q: Is there a fix for CVE-2026-44321?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-44321 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-44321?

Check whether you run free5GC Smf or github.com/free5gc/smf (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44321 · Severity: high · CVSS 7.5 · Published 2026-05-27

A vulnerability in the Session Management Function (SMF) of the free5GC 5G core network allows an unauthenticated attacker to crash the service. By sending a specially crafted request to a management endpoint that lacks proper security checks, an attacker can force the entire SMF process to terminate. This results in a complete denial of service, preventing the mobile network from establishing or managing user data sessions until the system is manually restarted.

Technologies: free5GC Smf, github.com/free5gc/smf (Go). Vendors: free5GC, Go.

Quick answers

Is CVE-2026-44321 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-44321 being exploited in the wild.
How severe is CVE-2026-44321?: High severity, with a CVSS score of 7.5, published 27 May 2026.
Which products and versions are affected?: free5GC Smf < 4.2.2, <= 1.4.3; github.com/free5gc/smf (Go) <= 1.4.3, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.4.3.
Is there a fix for CVE-2026-44321?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-44321 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-44321?: Check whether you run free5GC Smf or github.com/free5gc/smf (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The free5GC Session Management Function (SMF) fails to apply OAuth2 authentication/authorization middleware to the 'UPI' management route group (CWE-306, CWE-862). The 'POST /upi/v1/upNodesLinks' handler passes attacker-controlled JSON to 'UpNodesFromConfiguration()', which performs validation using 'logger.InitLog.Fatalf()'. Because 'Fatalf' in Go's standard logger (or equivalent wrappers) typically calls 'os.Exit(1)', a validation failure—such as providing a UE IP pool that overlaps with an existing one—terminates the entire SMF process rather than just the request goroutine. This allows a remote, unauthenticated attacker to cause a persistent denial of service by repeatedly crashing the SMF. A fix is available in the upstream SMF repository.

Affected products

free5gc smf <= 1.4.3

Identifiers

CVE-2026-44321
GHSA-44qj-cghf-9p97
GO-2026-5109

Timeline

2026-03-22: other: Vulnerability validated in lab environment
2026-05-07: disclosed: Advisory published to free5gc/free5gc repository
2026-05-08: advisory: GitHub Advisory GHSA-44qj-cghf-9p97 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.