CVE-2026-30050 in Free5GC
Summary
by MITRE • 08/27/2026
An issue in the ModifyAMFEventSubscriptionProcedure function (processor/event_exposure.go) of free5gc v4.1.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted PATCH request.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/27/2026
The vulnerability identified within the free5GC open-source 5G core network implementation, specifically affecting version 4.1.0, resides in the ModifyAMFEventSubscriptionProcedure function located in the processor/event_exposure.go module. This component is responsible for handling requests related to modifying existing event subscriptions managed by the Access and Mobility Management Function (AMF). In a standard 5G architecture, the AMF interacts with various network functions and external applications via the Namf_EventExposure service interface, which utilizes HTTP/2 based RESTful APIs defined in the 3GPP TS 29.518 specification. The specific flaw allows an attacker to trigger a Denial of Service condition by submitting a maliciously crafted PATCH request that exploits improper validation or resource management logic within this procedure.
From a technical perspective, the root cause lies in how the function processes incoming subscription modification payloads without adequate safeguards against malformed or excessively complex data structures. When a client sends a PATCH request to modify an event subscription, the server parses the JSON body and attempts to update internal state variables or trigger downstream notifications. If the input contains specific crafted fields that lead to infinite loops, excessive memory allocation, or unhandled exceptions during the processing of subscription updates, the application may hang or crash. This lack of robust error handling and resource limits means that a single malicious request can consume disproportionate CPU cycles or memory resources, effectively rendering the AMF instance unavailable for legitimate traffic.
The operational impact of this vulnerability is severe within the context of 5G network infrastructure. Since the AMF serves as a central control plane entity responsible for managing mobility and session states for User Equipment (UE), its unavailability disrupts critical signaling flows. A successful exploitation could prevent new UEs from registering to the network, cause existing sessions to drop due to timeout errors in state synchronization, or block essential location updates and handover procedures. This results in a complete service outage for subscribers connected through the affected AMF instance, leading to significant downtime and potential financial loss for mobile network operators relying on this open-source solution.
This vulnerability aligns with CWE-400, which describes Uncontrolled Resource Consumption, as the flaw allows an external actor to exhaust system resources such as memory or CPU time through a single interaction. Furthermore, it maps to MITRE ATT&CK technique T1499, Endpoint Denial of Service, specifically under the sub-category of Oscillation, where the attacker repeatedly sends requests that cause the target service to fluctuate between available and unavailable states, or simply exhausts resources until failure occurs. The attack vector is classified as Network-based with Low Complexity, requiring only network access to the AMF interface without prior authentication if proper security controls are not enforced at the gateway level.
Mitigation strategies should focus on both immediate patching and architectural hardening. Operators running free5GC v4.1.0 must upgrade to a patched version where this specific input validation issue has been resolved by the vendor or community maintainers. In addition, implementing strict rate limiting and request size constraints at the API gateway level can help mitigate the impact of such attacks before they reach the application logic. It is also recommended to enable detailed logging for event exposure endpoints to monitor for anomalous patterns in PATCH requests that may indicate exploitation attempts. Ensuring that the AMF runs with appropriate resource limits, such as memory caps and CPU quotas within containerized environments like Kubernetes, can further contain the blast radius of any successful DoS attempt.