CVE-2026-30062 in free5GC
Summary
by MITRE • 08/27/2026
An issue in the NGAP handler of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted NAS PDU.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/27/2026
The vulnerability identified within the Next Generation Application Protocol (NGAP) handler of free5GC version 4.0.1 represents a critical security flaw in open-source implementations of the 5G core network architecture. NGAP serves as the signaling protocol responsible for managing session establishment, mobility management, and paging procedures between the Radio Access Network and the Core Network. In this specific instance, the defect lies within the parsing logic that processes Non-Access Stratum Protocol Data Units sent by user equipment or simulated clients. The flaw allows an attacker to craft a malicious NAS PDU containing malformed data structures that trigger unhandled exceptions or infinite loops during processing. This behavior effectively exhausts system resources such as CPU cycles and memory, leading to a Denial of Service condition where legitimate network functions become unavailable.
From a technical perspective, the root cause is typically associated with improper input validation and lack of bounds checking when parsing variable-length fields within the NAS message structure. When the NGAP handler receives the crafted PDU, it fails to verify the integrity or length constraints before attempting to allocate memory or execute subsequent logic based on that data. This oversight results in a crash of the specific network function instance handling the session or an unresponsive state where the process hangs indefinitely. Such vulnerabilities are particularly dangerous in 5G environments because they target foundational signaling protocols, potentially disrupting connectivity for all users attached to the affected base station or core node without requiring authentication credentials if exposed via open interfaces like N2.
The operational impact of this vulnerability is severe, as it directly compromises the availability pillar of information security within telecommunications infrastructure. An attacker with network access to the NGAP interface can launch a remote denial-of-service attack that disrupts service for multiple subscribers simultaneously. This disruption prevents users from establishing data sessions, making voice calls, or receiving paging messages, effectively rendering the mobile network unusable in the affected area. Furthermore, because free5GC is often used in research and development environments as well as production deployments by smaller operators, the risk extends to critical infrastructure that may lack robust perimeter defenses specifically tuned for signaling protocol anomalies.
This vulnerability aligns with CWE-20 Improper Input Validation and CWE-400 Uncontrolled Resource Consumption under the Common Weakness Enumeration taxonomy. In terms of offensive security frameworks, it maps to MITRE ATT&CK technique T1498 Network Denial of Service, specifically involving resource exhaustion through signaling protocol abuse. To mitigate this risk, operators should ensure they are running patched versions of free5GC where input validation logic has been hardened against malformed NAS PDUs. Additionally, implementing strict rate limiting and deep packet inspection at the network perimeter can help filter out anomalous NGAP traffic before it reaches vulnerable core functions. Regular security audits focusing on signaling protocol parsers and deploying intrusion detection systems capable of identifying abnormal NAS message patterns are essential defensive measures to maintain service availability in 5G networks.