CVE-2026-30051 in Free5GC
Summary
by MITRE • 08/27/2026
An issue in the CreateUEContextProcedure function (/v1/ue-contexts/{supi}) of free5gc v4.1.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted PUT request.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/28/2026
The vulnerability identified within the free5GC open-source 5G core network implementation, specifically affecting version 4.1.0, resides in the CreateUEContextProcedure function exposed through the HTTP/2 interface at the endpoint /v1/ue-contexts/{supi}. This component is responsible for establishing and managing the context of a User Equipment (UE) within the 5G system architecture. The flaw allows an attacker to trigger a Denial of Service condition by submitting a specifically crafted PUT request that exploits improper input validation or resource handling mechanisms during the procedure execution.
From a technical perspective, this vulnerability is classified under CWE-400: Uncontrolled Resource Consumption. When the CreateUEContextProcedure function processes incoming requests, it fails to adequately validate the size, structure, or complexity of the data provided in the PUT request body. This lack of rigorous validation enables an attacker to supply malformed or excessively large payloads that cause the server process to enter a loop, consume excessive CPU cycles, exhaust available memory resources, or hang indefinitely while attempting to parse or allocate context for the non-compliant input. The absence of proper bounds checking and resource limits during this critical initialization phase creates a direct path for service disruption without requiring authentication in some configurations, or by leveraging valid but maliciously constructed credentials if access controls are present.
The operational impact of this vulnerability is severe within the context of 5G network infrastructure. Since free5GC serves as an open-source implementation of the Access and Mobility Management Function (AMF) and other core components, a successful exploitation can lead to the unavailability of critical signaling services for legitimate users. An attacker could systematically target multiple UE contexts simultaneously, causing cascading failures across the control plane. This results in service degradation where authorized subscribers are unable to register with the network, establish data sessions, or maintain connectivity. In a production environment, this translates directly to business disruption and potential loss of trust in the telecommunications provider's reliability.
In terms of threat modeling, this attack vector aligns with MITRE ATT&CK technique T1498: Network Denial of Service, specifically under sub-techniques involving resource exhaustion through application layer attacks. The attacker leverages the stateful nature of the UE context creation process to tie up server resources indefinitely or until system limits are reached. This is particularly dangerous in 5G environments where signaling traffic volume can be high, and automated systems may attempt to retry failed connections, thereby amplifying the impact of a single crafted request into a widespread outage scenario.
Mitigation strategies must focus on hardening the input validation logic within the free5GC codebase. Developers should implement strict schema validation for all incoming PUT requests targeting the /v1/ue-contexts/{supi} endpoint to ensure that only well-formed and expected data structures are processed. Additionally, applying rate limiting and request size restrictions at both the application layer and any preceding reverse proxy or load balancer can help mitigate the impact of such attacks by preventing oversized payloads from reaching the vulnerable function. Upgrading to patched versions of free5GC where this issue has been resolved is the most effective long-term solution. Security teams should also monitor for anomalous spikes in PUT request volume targeting UE context endpoints as an indicator of potential exploitation attempts and integrate these checks into their intrusion detection systems.