Junglewise Threat Intelligence

CVE-2026-53551: free5gc AUSF improper input validation in supiOrSuci field

CVE-2026-53551 · Severity: medium · CVSS 6.9 · Published 2026-07-31

Executive brief

The free5GC Authentication Server Function (AUSF), which manages user identity verification in 5G networks, fails to properly check incoming authentication requests for hidden control characters. An attacker can send specially crafted requests containing null bytes to cause the service to fail with an internal error. This results in a denial-of-service condition where legitimate mobile subscribers are unable to authenticate and connect to the network.

Technical details

The vulnerability exists in the AUSF's 'POST /nausf-auth/v1/ue-authentications' handler due to improper input validation (CWE-20). The service accepts JSON strings containing null bytes (\x00) and embeds them directly into a URL path used to communicate with the Unified Data Management (UDM) function. Because Go's 'net/url.Parse()' rejects URLs containing control characters, the request fails, causing the AUSF to return an HTTP 500 error and leak internal stack traces. This can be exploited by an unauthenticated network attacker to perform a denial-of-service attack against all subscribers attempting authentication. The issue is resolved in free5GC v4.2.2 and AUSF v1.4.5 by implementing input validation and URL escaping.

Affected products

  • free5GC free5gc/ausf < 1.4.5
  • free5GC free5gc/free5gc < 4.2.2

Timeline

  • 2026-06-10: disclosed: Initial report by Alonza0314
  • 2026-07-31: advisory: GitHub Advisory published
  • 2026-07-31: patched: Fixes released in free5gc v4.2.2 and ausf v1.4.5

References

Related threats