Vulnerability · Published Aug 28, 2026 · Assigned by GitHub_M
CVE-2026-55784free5GC AUSF authentication contexts can be overwritten by concurrent requests for the same SUPI
High 7.5
In plain English
A high-severity race condition in free5gc from free5gc. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).
Official description
free5GC is an open-source implementation of the 5G core network. In version 1.4.4 and earlier, the AUSF component stores per-subscriber authentication state in a global sync.Map named AUSFContext.UePool in internal/context/context.go, keyed only by SUPI. Every request handled by internal/sbi/processor/ue_authentication.go creates an AusfUeContext, and AddAusfUeContextToPool executes ausfContext.UePool.Store(ausfUeContext.Supi, ausfUeContext), unconditionally replacing the active context for that SUPI. An attacker with access to the AUSF SBI/N12 interface can send concurrent POST /nausf-auth/v1/ue-authentications requests for the same target SUPI, causing all attempts to share one logical authentication context URL while K_aut, XRES, and EapID are repeatedly overwritten. A valid EAP-AKA' response for an earlier challenge is then checked against the latest context, causing AT_MAC verification to fail and denying authentication to the selected subscriber while the request flood continues. No fixed version is available as of this review.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/free5gc/ausf | no fix listed | GHSA-334q-h5g3-fpxv |
| Go | github.com/free5gc/ausf | no fix listed | GO-2026-6326 |
Affected products (as reported)
Weakness: CWE-362 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://github.com/free5gc/free5gc/security/advisories/GHSA-334q-h5g3-fpxv x_refsource_CONFIRM