CVE-2026-30057 in Free5GC
Summary
by MITRE • 08/27/2026
An issue in the CreateUEContext handler component of free5gc v4.1.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted request.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/27/2026
The vulnerability identified within the free5GC open-source 5G core network implementation, specifically affecting version 4.1.0, resides in the CreateUEContext handler component. This function is responsible for managing the establishment of context information between the Access and Mobility Management Function (AMF) and other network functions when a User Equipment attempts to establish or modify its connection state within the 5G system architecture. The flaw allows an attacker who can interact with this specific API endpoint to trigger a Denial of Service condition by supplying a specially crafted request that exploits improper input validation or resource handling logic within the handler.
From a technical perspective, the root cause typically involves insufficient checks on parameters passed during the context creation process. In many implementations of such handlers, failure to properly validate the length, structure, or content of incoming JSON payloads can lead to memory corruption, infinite loops, or unhandled exceptions that crash the service thread. When an attacker submits a malformed request designed to trigger these edge cases, the application may fail to recover gracefully, leading to process termination or significant degradation in performance for other legitimate users sharing the same resources. This aligns with CWE-20 Improper Input Validation and potentially CWE-400 Uncontrolled Resource Consumption if the flaw leads to excessive resource allocation without proper limits.
The operational impact of this vulnerability is severe within a 5G network environment, as free5GC serves as a critical infrastructure component for mobile connectivity simulation and deployment. A successful exploitation results in the unavailability of services provided by the AMF or related functions that depend on stable UE context management. This disruption can prevent legitimate users from registering with the network, making voice over New Radio calls, or accessing data sessions. In a production-like scenario involving free5GC integrated with other core elements like the Session Management Function and User Plane Function, this instability could cascade, causing broader service outages that affect multiple subscribers simultaneously.
This vulnerability is categorized under MITRE ATT&CK technique T1499 Endpoint Denial of Service, as it involves actions taken to disrupt or deny services to intended users by exhausting resources or crashing the endpoint software. The attack vector likely requires network-level access to the AMF interface, placing it in a high-privilege context if not properly segmented within the service mesh or microservices architecture typical of 5G core deployments.
Mitigation strategies should focus on rigorous input validation and robust error handling mechanisms within the CreateUEContext handler code. Developers must ensure that all fields in incoming requests are strictly validated against expected schemas, including data types, lengths, and allowed values. Implementing rate limiting and request size restrictions can also help mitigate the impact of such attacks by preventing a single entity from overwhelming the service with malformed or excessive traffic. Additionally, deploying the application within containerized environments with resource quotas ensures that even if an exploit is attempted, the damage remains contained to the specific pod or instance rather than affecting the entire host system. Regular security audits and fuzz testing of API endpoints are recommended to identify similar flaws before they can be exploited in live environments.