CVE-2026-30060 in free5GC
Summary
by MITRE • 08/27/2026
An issue in free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) when parsing crafted SUCI data during UE registration.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/27/2026
The vulnerability identified within the free5GC open-source 5G core network implementation, specifically affecting version 4.0.1, represents a critical security flaw in the handling of Subscription Concealed Identifier data during the initial access and authentication procedures. This issue stems from an improper validation or parsing mechanism when processing SUCI payloads submitted by User Equipment attempting to register with the network. The free5GC project serves as a widely adopted reference implementation for 5G core networks, making any instability in its fundamental registration flows particularly significant for developers and operators testing or deploying this software stack.
From a technical perspective, the flaw resides in the parsing logic responsible for decoding SUCI structures received during the UE Registration Request message exchange. When an attacker crafts maliciously formatted SUCI data, it triggers an unhandled exception or infinite loop within the parser component of the free5GC AMF (Access and Mobility Management Function). This behavior prevents the application from continuing normal execution flow, effectively causing a crash or severe hang in the affected service instance. The root cause is typically classified under CWE-20 as Improper Input Validation, where the software fails to adequately sanitize or validate external input before processing it within critical system functions.
The operational impact of this vulnerability is primarily focused on availability, manifesting as a Denial of Service condition for the specific network function instance targeted by the attack. Since SUCI parsing occurs early in the registration procedure, an attacker can exploit this flaw to disrupt the ability of legitimate users to register with the 5G core or cause the AMF service itself to become unresponsive. In a production environment, such instability could lead to cascading failures if load balancing mechanisms fail to detect and isolate the compromised node quickly enough. This directly impacts Service Level Agreements related to network uptime and reliability, potentially causing widespread connectivity issues for subscribers relying on that specific core instance.
This vulnerability aligns with MITRE ATT&CK technique T1499, Endpoint Denial of Service, as it involves exhausting or disrupting resources through malicious input rather than resource consumption via legitimate but heavy traffic. It also relates to CWE-787, Out-of-bounds Write, if the parsing error leads to memory corruption that crashes the process, although the primary observed effect is service unavailability due to exception handling failures. The attack vector requires network-level access to inject crafted registration messages into the N1 interface between the User Equipment and the AMF, which implies a local or man-in-the-middle position within the radio access network context unless other authentication bypasses are present.
Mitigation strategies for this vulnerability involve immediate patching of the free5GC software stack to version 4.0.2 or later where the parsing logic has been hardened with robust error handling and input validation checks. Developers should ensure that all SUCI fields, including encryption scheme identifiers and key set identifiers, are strictly validated against expected formats before being passed to cryptographic libraries. Additionally, deploying network-level intrusion detection systems capable of identifying anomalous registration request patterns can provide a layer of defense in depth. For organizations still running version 4.0.1, restricting access to the N1 interface to trusted endpoints and implementing rate limiting on registration requests are recommended temporary countermeasures until an official patch is applied.