Vulnerability · Published May 27, 2026 · Assigned by GitHub_M
CVE-2026-44323free5GC: UDR nudr-dr DELETE amf-subscriptions panics on missing subsId when UE state exists (nil pointer dereference)
Medium 4.3
In plain English
A medium-severity null pointer dereference in free5gc from free5gc. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's UDR nudr-dr DELETE /subscription-data/{ueId}/{servingPlmnId}/ee-subscriptions/{subsId}/amf-subscriptions handler contains a nil-pointer dereference reachable from a single authenticated request, after one preparatory authenticated EE-subscription create. The handler checks _, ok = UESubsData.EeSubscriptionCollection[subsId] and sets a 404 problem-details on the miss path, but then continues to UESubsData.EeSubscriptionCollection[subsId].AmfSubscriptionInfos -- dereferencing the same missing entry instead of returning. Gin recovery converts the panic into HTTP 500, but the endpoint remains repeatedly panicable. This vulnerability is fixed in 4.2.2.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/free5gc/udr | 1.4.3 | GHSA-4rqf-grm6-vf75 |
| Go | github.com/free5gc/udr | 1.4.3 | GO-2026-5131 |
Affected products (as reported)
Weakness: CWE-476 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
References
- https://github.com/free5gc/free5gc/security/advisories/GHSA-4rqf-grm6-vf75 x_refsource_CONFIRM
- https://github.com/free5gc/free5gc/issues/919 x_refsource_MISC
- https://github.com/free5gc/udr/pull/60 x_refsource_MISC
- https://github.com/free5gc/udr/commit/8a1d3c63be99d378806d771f086ff32f1867da99 x_refsource_MISC