Executive brief
A vulnerability in the free5GC Session Management Function (SMF) allows an unauthenticated attacker to delete critical network nodes from the system's memory. The SMF is a core component of 5G networks responsible for managing user sessions; by exploiting this flaw, an attacker can disrupt network connectivity and cause the management service to crash. This can lead to a denial of service for mobile users and require manual intervention to restore the network's topology.
Technical details
The free5GC SMF UPI management route group is mounted without OAuth2 authentication middleware, making its endpoints reachable unauthenticated. In the 'DELETE /upi/v1/upNodesLinks/{ref}' handler, the code unconditionally dereferences the 'UPF' field of a node object. However, Access Network (AN) nodes are constructed with a nil 'UPF' field, leading to a nil pointer dereference and a panic. Crucially, the 'UpNodeDelete' function is called before the panic occurs, meaning the in-memory user-plane topology is mutated (nodes are deleted) even if the request fails. This allows an off-path network attacker to persistently deny SMF's ability to establish PFCP paths for UE sessions. The issue is fixed in SMF version 1.4.3.
Affected products
- free5GC SMF < 1.4.3
Timeline
- 2026-05-07: disclosed
- 2026-05-08: advisory: GitHub Advisory published
- 2026-05-27: other: NVD published