CVE-2026-44324: free5GC UDR denial of service via nil type assertion

Executive brief

A vulnerability in the free5GC Unified Data Repository (UDR) allows an authenticated user to crash the service's request handler. The UDR is a core component of 5G networks responsible for storing subscriber data. By sending a specific request for a non-existent user, an attacker can cause a service panic, leading to a denial-of-service condition for that specific endpoint.

Technical details

The vulnerability is a Go nil interface type assertion (CWE-704) in the RemoveAmfSubscriptionsInfoProcedure of the UDR component. When a DELETE request is made to the amf-subscriptions endpoint with a non-existent ueId, the code correctly identifies the missing user but fails to return early. It subsequently attempts a type assertion on a nil interface returned by sync.Map.Load, causing a panic. While the Gin framework recovers from the panic to prevent a full process crash, the endpoint remains susceptible to repeated authenticated DoS attacks. The issue is fixed in version 1.4.3.

Affected products

• free5GC udr < 1.4.3

Timeline

• 2026-03-22: other: Vulnerability validated in lab environment
• 2026-05-07: disclosed
• 2026-05-08: advisory
• 2026-05-27: other: NVD published date

References

• https://api.github.com/users/LinZiyuu
• https://github.com/LinZiyuu
• https://api.github.com/users/LinZiyuu/gists%7B/gist_id%7D
• https://api.github.com/users/LinZiyuu/repos
• https://avatars.githubusercontent.com/u/104151270?v=4
• https://api.github.com/users/LinZiyuu/events%7B/privacy%7D