Log in Start free

Vulnerability · Published Jul 31, 2026 · Assigned by GitHub_M

CVE-2026-53551free5GC AUSF: null byte injection in supiOrSuci causes HTTP 500 internal service failure

Medium 6.9

In plain English

A medium-severity improper input validation in ausf from free5gc. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 55% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.9Medium
Exploit odds (30 days)0.7%top 45.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

free5GC is an open-source implementation of the 5G core network. Prior to 1.4.5, the free5GC AUSF (Authentication Server Function) does not validate the supiOrSuci field in UE authentication requests. Null bytes (\x00) and other control characters pass through JSON parsing unchanged and are forwarded to the UDM in an unescaped URL path. This causes Go's net/url.Parse() to fail, returning HTTP 500 "System failure" and leaking internal stack traces. An unauthenticated attacker can trigger this at scale causing denial of service for all subscribers attempting authentication through the affected AUSF. This vulnerability is fixed in 1.4.5.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gogithub.com/free5gc/ausf1.4.5GHSA-qj55-47fp-p62j
Gogithub.com/free5gc/ausf1.4.5GO-2026-6161
Gogithub.com/free5gc/free5gc4.2.2GHSA-qj55-47fp-p62j
Gogithub.com/free5gc/free5gc4.2.2+incompatibleGO-2026-6161

Affected products (as reported)

VendorProductVersions
free5gc free5gc < 4.2.2
free5gc ausf < 1.4.5

Weakness: CWE-20 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References