CVE-2026-44325

HIGH EPSS 31.2%
Published May 27, 20261mo ago · Modified Jun 17, 20262w ago
7.5 CVSS 3.1
High
Find Similar
Published May 27, 2026 1mo ago
Last Modified Jun 17, 2026 2w ago

Description

free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's NRF root SBI endpoint POST /oauth2/token contains a parser-level type-confusion bug family. The handler in NFs/nrf/internal/sbi/api_accesstoken.go reflects over models.NrfAccessTokenAccessTokenReq, special-cases only plain string and NrfNfManagementNfType fields, and treats every other field as if it were a single models.PlmnId. The parsed *models.PlmnId is then assigned with reflect.Value.Set() to whichever field name the attacker put in the form body, which panics whenever the destination field's real type is incompatible (slice, different struct, primitive). Gin recovery converts each panic into HTTP 500, but the endpoint remains remotely panicable from a single unauthenticated form-encoded request and is repeatedly triggerable. This vulnerability is fixed in 4.2.2.

CVSS Details

Base Score
7.5
Exploitability
3.9
Impact
3.6
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality None
Integrity None
Availability High

Threat Intelligence

EPSS Exploit Probability
31.2% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 3

CWE-20 Improper Input Validation Validation
CWE-755
CWE-843

Affected Products 1

VendorProductVersionRange
free5gcfree5gc* <4.2.2

References 4

  • github.com https://github.com/free5gc/free5gc/issues/918
    ExploitIssue Tracking
  • github.com https://github.com/free5gc/free5gc/security/advisories/GHSA-f8qv-7x5w-qr48
    ExploitVendor Advisory
  • github.com https://github.com/free5gc/nrf/commit/f7bc77daa7425506af7569f2e61c2a210f5a0423
    Patch
  • github.com https://github.com/free5gc/nrf/pull/83
    Issue TrackingPatch

Remediation

  • github.com https://github.com/free5gc/nrf/commit/f7bc77daa7425506af7569f2e61c2a210f5a0423
    Patch
  • github.com https://github.com/free5gc/nrf/pull/83
    Issue TrackingPatch