# CVE-2026-44325: free5GC NRF type confusion in OAuth2 token endpoint

Source: https://junglewise.ai/threats/cve-2026-44325-free5gc-nrf-type-confusion-in-oauth2-token-endpoint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-27. Updated: 2026-06-09  
License: CC BY 4.0 with a link back

CVE-2026-44325 · Severity: high · CVSS 7.5 · Published 2026-05-27

A vulnerability in the free5GC Network Repository Function (NRF) allows an unauthenticated attacker to cause a service error by sending a specially crafted request to the token issuance endpoint. The NRF is a core component of 5G networks used for service discovery and authorization. While the system automatically recovers from these errors, a sustained attack could degrade performance, increase processing costs, and flood system logs with diagnostic data.

Technologies: [free5GC NRF](https://junglewise.ai/threats/technologies/nrf), [github.com/free5gc/nrf (Go)](https://junglewise.ai/threats/technologies/github-com-free5gc-nrf). Vendors: [free5GC](https://junglewise.ai/threats/vendors/free5gc), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-44325 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44325 being exploited in the wild.

**How severe is CVE-2026-44325?** High severity, with a CVSS score of 7.5, published 27 May 2026.

**Which products and versions are affected?** free5GC NRF < 1.4.3, <= 4.2.1; github.com/free5gc/nrf (Go) < 1.4.3, SEMVER:introduced=0,fixed=1.4.3.

**Is there a fix for CVE-2026-44325?** Yes. github.com/free5gc/nrf (Go): upgrade to 1.4.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44325 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-44325?** Check whether you run free5GC NRF or github.com/free5gc/nrf (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/free5gc/nrf (Go): upgrade to 1.4.3 or later

  ```sh
  go get github.com/free5gc/nrf@v1.4.3
  ```


## Technical details

A type-confusion vulnerability (CWE-843) exists in the `POST /oauth2/token` handler within `NFs/nrf/internal/sbi/api_accesstoken.go`. The parser uses Go reflection to map form-encoded body fields to the `models.NrfAccessTokenAccessTokenReq` struct but fails to validate that the input types match the destination field types. Specifically, it attempts to use `reflect.Value.Set()` to assign a `*models.PlmnId` type to fields expecting slices or different pointer types (e.g., `[]models.PlmnId`, `[]string`), leading to a runtime panic. While the Gin web framework catches these panics to prevent a full process crash, an unauthenticated attacker can repeatedly trigger this expensive failure path to cause resource exhaustion and log pollution. The issue is fixed in version 1.4.3.

## Affected products

- free5GC nrf < 1.4.3

## Identifiers

- CVE-2026-44325
- GHSA-f8qv-7x5w-qr48
- GO-2026-5349

## Timeline

- 2026-03-22: other: Vulnerability validated in lab environment
- 2026-05-07: advisory: GitHub Advisory published
- 2026-05-08: disclosed: Public disclosure

## References

- [https://api.github.com/users/LinZiyuu](https://api.github.com/users/LinZiyuu)
- [https://github.com/LinZiyuu](https://github.com/LinZiyuu)
- [https://api.github.com/users/LinZiyuu/gists%7B/gist_id%7D](https://api.github.com/users/LinZiyuu/gists%7B/gist_id%7D)
- [https://api.github.com/users/LinZiyuu/repos](https://api.github.com/users/LinZiyuu/repos)
- [https://avatars.githubusercontent.com/u/104151270?v=4](https://avatars.githubusercontent.com/u/104151270?v=4)
- [https://api.github.com/users/LinZiyuu/events%7B/privacy%7D](https://api.github.com/users/LinZiyuu/events%7B/privacy%7D)

## Related threats

- [free5GC NRF input validation bypass in NF profile registration](https://junglewise.ai/threats/cve-2026-55068-free5gc-nrf-input-validation-bypass-in-nf-profile-registration)
- [GO-2026-4756 - free5GC NRF Discovery EncodeGroupId Function Panics on Malformed group-id-list Parameter in github.com/free5gc/nrf](https://junglewise.ai/threats/cve-2026-33062-free5gc-nrf-discovery-encodegroupid-function-panics-on-malformed)
- [Free5gc NRF scope validation bypass in access-token generation](https://junglewise.ai/threats/cve-2025-66719-free5gc-nrf-scope-validation-bypass-in-access-token-generation)