# CVE-2026-75439: Free5GC UPF nil pointer dereference in PFCP Session Report

Source: https://junglewise.ai/threats/cve-2026-75439-free5gc-upf-nil-pointer-dereference-in-pfcp-session-report  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-04. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-75439 · Severity: high · CVSS 7.5 · Published 2026-09-04

Free5GC is an open-source 5G network core implementation used to build mobile network infrastructure. The UPF (User Plane Function) component crashes when it receives a delayed session report for an already-deleted session, causing the entire user plane to become unavailable and interrupting mobile data service for all connected devices.

Technologies: [free5GC](https://junglewise.ai/threats/technologies/free5gc). Vendors: [free5GC](https://junglewise.ai/threats/vendors/free5gc).

## Quick answers

**Is CVE-2026-75439 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-75439 being exploited in the wild.

**How severe is CVE-2026-75439?** High severity, with a CVSS score of 7.5, published 4 September 2026.

**Which products and versions are affected?** free5GC v4.2.2.

**Is there a fix for CVE-2026-75439?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-75439 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-75439?** Check whether you run free5GC at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a nil pointer dereference in the UPF component's PFCP (Packet Forwarding Control Protocol) session handling. When a PFCP Session Report Response arrives for a session that has already been deleted locally, the code performs a session lookup that returns nil but fails to check for this condition before dereferencing the pointer, causing a panic. The attack is remotely triggered by sending a delayed or out-of-order PFCP Session Report Response message to the UPF network interface (typically reachable from other 5G core components). No authentication is required. Successful exploitation results in immediate denial of service as the UPF process crashes and stops processing user data traffic.

## Affected products

- Free5GC Free5GC v4.2.2

## Timeline

- 2026-06-04: disclosed: Bug reported on GitHub issue #1059
- 2026-09-04: other: CVE-2026-75439 published

## References

- [https://gist.github.com/hackeryounow/0f434c03008462e6eec3b43ed3cd12d8](https://gist.github.com/hackeryounow/0f434c03008462e6eec3b43ed3cd12d8)
- [https://github.com/free5gc/free5gc/issues/1059](https://github.com/free5gc/free5gc/issues/1059)

## Related threats

- [Free5GC SMF resource exhaustion in PFCP session establishment](https://junglewise.ai/threats/cve-2026-106805-a-resource-exhaustion-issue-exists-in-free5gc-v4-2-3-during-pfcp)
- [Free5GC race condition in GMM handler RanUe context access](https://junglewise.ai/threats/cve-2026-94043-a-vulnerability-was-determined-in-free5gc-up-to-4-2-3-this)
- [free5GC NRF input validation bypass in NF profile registration](https://junglewise.ai/threats/cve-2026-55068-free5gc-nrf-input-validation-bypass-in-nf-profile-registration)
- [free5gc NSSF nil pointer dereference in NssaiAvailabilitySubscriptionCreate](https://junglewise.ai/threats/cve-2026-30073-free5gc-nssf-nil-pointer-dereference-in)
- [free5gc RechargePut denial of service in input parsing](https://junglewise.ai/threats/cve-2026-30071-free5gc-rechargeput-denial-of-service-in-input-parsing)