Executive brief
A vulnerability in the free5GC Network Exposure Function (NEF) can cause the service to crash internally when processing specific update requests. This occurs when the system attempts to handle a failure from an upstream database component but incorrectly references missing data. While the service automatically recovers from the crash, it results in a failed request (HTTP 500 error) and could be used to disrupt specific management operations.
Technical details
A NULL pointer dereference (CWE-476) exists in the free5GC NEF 'PatchIndividualApplicationPFDManagement' handler. When an upstream Unified Data Repository (UDR) call fails, the error handling branch incorrectly attempts to access a field ('Cause') from a nil 'problemDetails' object instead of the locally initialized error object. This vulnerability is reachable via unauthenticated PATCH requests to the 3gpp-pfd-management API because the route group lacks mandatory authorization middleware in affected versions. While the Gin web framework's recovery middleware prevents a full process exit by converting the panic into an HTTP 500 response, an attacker can reliably trigger this state whenever upstream UDR connectivity is unstable or failing. The issue is fixed in NEF version 1.2.3.
Affected products
- free5GC NEF < 1.2.3
Timeline
- 2026-03-21: other: Vulnerability validated in lab environment
- 2026-05-08: disclosed
- 2026-05-08: advisory