# CVE-2026-53551: free5gc AUSF improper input validation in supiOrSuci field

Source: https://junglewise.ai/threats/cve-2026-53551-free5gc-ausf-improper-input-validation-in-supiorsuci-field  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-31. Updated: 2026-07-31  
License: CC BY 4.0 with a link back

CVE-2026-53551 · Severity: medium · CVSS 4 · Published 2026-07-31

The free5GC Authentication Server Function (AUSF), which manages user identity verification in 5G networks, fails to properly check incoming authentication requests for hidden control characters. An attacker can send specially crafted requests containing null bytes to cause the service to fail with an internal error. This results in a denial-of-service condition where legitimate mobile subscribers are unable to authenticate and connect to the network.

Technologies: [free5GC](https://junglewise.ai/threats/technologies/free5gc), [github.com/free5gc/ausf (Go)](https://junglewise.ai/threats/technologies/github-com-free5gc-ausf), [github.com/free5gc/free5gc (Go)](https://junglewise.ai/threats/technologies/github-com-free5gc-free5gc). Vendors: [free5GC](https://junglewise.ai/threats/vendors/free5gc), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-53551 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-53551 being exploited in the wild.

**How severe is CVE-2026-53551?** Medium severity, with a CVSS score of 4, published 31 July 2026.

**Which products and versions are affected?** free5GC < 1.4.5; github.com/free5gc/ausf (Go) < 1.4.5, SEMVER:introduced=0,fixed=1.4.5; github.com/free5gc/free5gc (Go) < 4.2.2, SEMVER:introduced=0,fixed=4.2.2, SEMVER:introduced=0,fixed=4.2.2+incompatible.

**Is there a fix for CVE-2026-53551?** Yes. github.com/free5gc/ausf (Go): upgrade to 1.4.5 or later; github.com/free5gc/free5gc (Go): upgrade to 4.2.2, 4.2.2+incompatible or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-53551 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-53551?** Check whether you run free5GC, github.com/free5gc/ausf (Go) or github.com/free5gc/free5gc (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/free5gc/ausf (Go): upgrade to 1.4.5 or later

  ```sh
  go get github.com/free5gc/ausf@v1.4.5
  ```

- github.com/free5gc/free5gc (Go): upgrade to 4.2.2, 4.2.2+incompatible or later

  ```sh
  go get github.com/free5gc/free5gc@v4.2.2+incompatible
  ```


## Technical details

The vulnerability exists in the AUSF's 'POST /nausf-auth/v1/ue-authentications' handler due to improper input validation (CWE-20). The service accepts JSON strings containing null bytes (\x00) and embeds them directly into a URL path used to communicate with the Unified Data Management (UDM) function. Because Go's 'net/url.Parse()' rejects URLs containing control characters, the request fails, causing the AUSF to return an HTTP 500 error and leak internal stack traces. This can be exploited by an unauthenticated network attacker to perform a denial-of-service attack against all subscribers attempting authentication. The issue is resolved in free5GC v4.2.2 and AUSF v1.4.5 by implementing input validation and URL escaping.

## Affected products

- free5GC free5gc/ausf < 1.4.5
- free5GC free5gc/free5gc < 4.2.2

## Identifiers

- CVE-2026-53551
- GHSA-qj55-47fp-p62j
- GO-2026-6161

## Timeline

- 2026-06-10: disclosed: Initial report by Alonza0314
- 2026-07-31: advisory: GitHub Advisory published
- 2026-07-31: patched: Fixes released in free5gc v4.2.2 and ausf v1.4.5

## References

- [https://github.com/free5gc/free5gc/security/advisories/GHSA-qj55-47fp-p62j](https://github.com/free5gc/free5gc/security/advisories/GHSA-qj55-47fp-p62j)
- [https://github.com/free5gc/free5gc/issues/1048](https://github.com/free5gc/free5gc/issues/1048)
- [https://github.com/free5gc/ausf/pull/61](https://github.com/free5gc/ausf/pull/61)
- [https://github.com/free5gc/ausf/commit/bfc4a10094dbacbd862baa4686829f3fcc06ce1e](https://github.com/free5gc/ausf/commit/bfc4a10094dbacbd862baa4686829f3fcc06ce1e)
- [https://github.com/free5gc/ausf/releases/tag/v1.4.5](https://github.com/free5gc/ausf/releases/tag/v1.4.5)
- [https://github.com/free5gc/free5gc/releases/tag/v4.2.2](https://github.com/free5gc/free5gc/releases/tag/v4.2.2)

## Related threats

- [Free5GC SMF resource exhaustion in PFCP session establishment](https://junglewise.ai/threats/cve-2026-106805-a-resource-exhaustion-issue-exists-in-free5gc-v4-2-3-during-pfcp)
- [Free5GC race condition in GMM handler RanUe context access](https://junglewise.ai/threats/cve-2026-94043-a-vulnerability-was-determined-in-free5gc-up-to-4-2-3-this)
- [Free5GC UPF nil pointer dereference in PFCP Session Report](https://junglewise.ai/threats/cve-2026-75439-free5gc-upf-nil-pointer-dereference-in-pfcp-session-report)
- [free5GC AUSF non-constant-time authentication comparison and sensitive logging](https://junglewise.ai/threats/cve-2026-55785-free5gc-ausf-non-constant-time-authentication-comparison-and)
- [free5GC AUSF authentication context race condition](https://junglewise.ai/threats/cve-2026-55784-free5gc-ausf-authentication-context-race-condition)