CVE-2026-30063 in Free5GC
Summary
by MITRE • 08/27/2026
An issue in the NF Discovery endpoint of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted snssais query.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/27/2026
The vulnerability identified within the 5G Core network function discovery service, specifically affecting version 4.0.1 of the open-source free5gc implementation, represents a significant availability risk to telecommunications infrastructure. This flaw resides in the handling of Session Network Slice Selection Assistance Information queries, commonly referred to as snssais parameters. In modern 5G architectures, the NF Discovery function is responsible for locating and providing contact information for other network functions based on requested service profiles. When an attacker submits a malformed or excessively complex crafted query targeting this endpoint, it triggers an internal processing error that leads to a Denial of Service condition. This type of vulnerability exploits the trust placed in input validation mechanisms within critical signaling interfaces, allowing external actors to disrupt essential communication pathways between network elements without requiring authentication credentials if exposed improperly.
From a technical perspective, the root cause typically involves insufficient sanitization or bounds checking when parsing the snssais parameter string. The NF Discovery endpoint may attempt to allocate resources or iterate through data structures associated with slice selection identifiers in an unbounded manner. If the crafted input contains specific sequences that trigger infinite loops, memory exhaustion, or stack overflows within the Go runtime environment used by free5gc, the service process will crash or become unresponsive. This results in a complete halt of discovery services for other network functions attempting to register or locate peers during normal operations. The impact is particularly severe because NF Discovery acts as a central directory; its failure prevents new user equipment from attaching to the network and disrupts ongoing sessions that rely on dynamic service function chaining, effectively creating a single point of failure in the control plane architecture.
The operational impact extends beyond simple service interruption for the affected instance. In a distributed 5G core deployment, the unavailability of NF Discovery can cause cascading failures across multiple network slices. Operators may experience an inability to provision services dynamically, leading to revenue loss and degraded quality of service for subscribers. Furthermore, because this vulnerability targets a standard-defined interface defined by 3GPP specifications, it highlights gaps in how open-source implementations adhere to strict protocol compliance regarding input validation. Attackers can leverage this flaw remotely if the NF Discovery endpoint is exposed over Nnrf interfaces without adequate rate limiting or deep packet inspection protections at the network perimeter. This makes it a viable vector for targeted disruption campaigns against mobile network operators relying on vulnerable versions of free5gc in testbeds, private networks, or production environments where updates have not been applied.
Mitigation strategies must focus on both immediate remediation and long-term architectural hardening. The primary defense is to upgrade the free5gc deployment to a patched version that addresses this specific input validation flaw. Until an official patch is available, operators should implement strict access control lists at the network layer to restrict traffic destined for the NF Discovery endpoint only from trusted internal IP ranges associated with authorized Network Functions. Additionally, deploying Web Application Firewalls or specialized telecom security gateways capable of inspecting HTTP/2 payloads can help filter out malformed snssais queries before they reach the application logic. It is also critical to enable robust logging and monitoring on the NF Discovery service to detect anomalous query patterns indicative of exploitation attempts. Adhering to industry standards such as CWE-20 for Improper Input Validation and aligning with ATT&CK techniques related to Service Exploitation can guide security teams in identifying similar weaknesses across other network functions within the core infrastructure. Regular penetration testing focused on signaling interfaces is recommended to ensure that input sanitization mechanisms remain effective against evolving attack vectors targeting 5G control plane components.