CVE-2026-30067 in Free5GC
Summary
by MITRE • 08/27/2026
An issue in the complexQueryFilterSubprocess function in the NRF Discovery service of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/27/2026
The vulnerability identified within the free5GC open-source 5G core network implementation specifically targets the complexQueryFilterSubprocess function located in the NRF Discovery service component. This architectural element is critical for managing service discovery requests, where Network Function Repository (NRF) instances validate and process query filters submitted by other network functions such as AMF or SMF to locate available services. The flaw arises from insufficient input validation and error handling mechanisms within this specific function when processing complex filter expressions. By submitting a specially crafted input string that exploits logical ambiguities or resource-intensive parsing paths, an attacker can trigger uncontrolled resource consumption or infinite loops during the evaluation of these filters. This behavior directly leads to a Denial of Service condition, effectively rendering the NRF instance unable to process legitimate discovery requests from other network components.
From a technical perspective, this issue represents a classic case of improper input validation leading to system instability. The complexQueryFilterSubprocess function is designed to parse and evaluate intricate query parameters that define service selection criteria. When faced with malformed or excessively nested filter structures crafted by an adversary, the underlying logic fails to properly bound execution time or memory allocation. This lack of safeguards allows a single malicious request to consume disproportionate CPU cycles or exhaust available stack space within the Go runtime environment hosting free5GC. The consequence is not merely a crash but a sustained degradation of service availability for all dependent network functions that rely on dynamic discovery capabilities, thereby disrupting the fundamental orchestration layer of the 5G standalone architecture.
The operational impact of this vulnerability extends beyond simple application downtime to compromise the integrity and reliability of the entire core network infrastructure. In a production environment, the NRF serves as the central directory for service availability; if it becomes unresponsive due to such an attack, other critical functions like the Access and Mobility Management Function or Session Management Function cannot locate endpoints for user plane establishment or mobility management. This disruption can lead to widespread call drops, data session failures, and a complete loss of connectivity for end-users connected through that specific network slice or instance. Furthermore, because free5GC is often used in research, testing, and potentially lightweight production deployments, the ease with which this DoS condition can be triggered poses a significant risk to environments where security hardening may not have been rigorously applied compared to commercial vendor implementations.
Mitigation strategies for this vulnerability primarily involve upgrading to patched versions of free5GC that include fixes for input sanitization in the complexQueryFilterSubprocess function. Until an official patch is available, operators should implement strict network-level access controls to restrict who can send discovery requests to the NRF instance. This includes limiting exposure to trusted internal networks only and avoiding direct internet-facing deployment without robust perimeter security devices capable of inspecting SIP or HTTP-based signaling traffic for anomalous patterns. Additionally, implementing rate-limiting policies on API endpoints associated with service discovery can help mitigate the impact by preventing a single source from overwhelming the system with rapid-fire crafted requests. Monitoring tools should be configured to detect unusual spikes in CPU usage or request latency originating from NRF services as an indicator of potential exploitation attempts.
This vulnerability aligns with CWE-20 Improper Input Validation, as the root cause is the failure to adequately sanitize and validate complex query filters before processing them within the application logic. It also maps to MITRE ATT&CK technique T1499 Endpoint Denial of Service, where an adversary leverages resource exhaustion through malformed inputs to disrupt service availability. Understanding these mappings helps security teams contextualize the risk within broader threat landscapes and prioritize remediation efforts based on standardized classification frameworks rather than isolated incident reports.