CVE-2026-30071 in Free5GC
Summary
by MITRE • 08/27/2026
An issue in the RechargePut function of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/27/2026
The vulnerability identified within the free5GC project, specifically affecting version 4.0.1, resides in the RechargePut function which is responsible for handling subscription data modifications or updates related to charging and policy control mechanisms. This component plays a critical role in the Service-Based Architecture of the fifth-generation core network by managing how user equipment interacts with network functions that govern resource allocation and billing policies. The flaw stems from insufficient input validation within this specific handler, allowing an attacker who can interact with the affected interface to supply malformed or excessively large data structures that exceed expected bounds or trigger unhandled exceptions in the underlying processing logic.
From a technical perspective, the root cause of this denial-of-service condition is likely related to improper boundary checks or lack of sanitization when parsing incoming payloads destined for the RechargePut endpoint. When an attacker crafts input that violates these implicit assumptions about data size, format, or structure, the function may enter an infinite loop, consume excessive memory resources, or crash entirely due to a segmentation fault or uncaught panic state in the Go runtime environment typical of free5GC implementations. This failure prevents the network function from processing legitimate requests, effectively rendering the associated service unavailable to other users and systems relying on it for connectivity management.
The operational impact of this vulnerability is significant within the context of 5G core networks where high availability and reliability are paramount. A successful exploitation results in a localized denial-of-service against the specific Network Function hosting free5GC v4.0.1, potentially disrupting session establishment, policy enforcement, or charging records for subscribers connected to that instance. In a standalone deployment, this could lead to complete service outage for all users routed through that node. Even in distributed environments, it contributes to resource exhaustion and requires manual intervention such as restarting the container or virtual machine hosting the vulnerable component, thereby increasing operational overhead and reducing overall system resilience against targeted attacks.
This vulnerability aligns with Common Weakness Enumeration category CWE-20 Improper Input Validation, as the core issue is the failure to adequately verify data integrity before processing. Furthermore, it maps to MITRE ATT&CK technique T1498 Network Denial of Service, specifically reflecting behaviors that involve resource exhaustion or loop-induced service disruption rather than direct traffic flooding. The attack vector typically requires network access to the affected API endpoint, which may be internal within a cloud-native deployment but could become external if exposed via ingress controllers without proper authentication and rate limiting controls in place.
Mitigation strategies should prioritize immediate patching by upgrading free5GC to a version where this input validation flaw has been corrected by the development team. In environments where updating is not immediately feasible, defensive measures include implementing strict API gateway policies that enforce payload size limits and schema validation before requests reach the application logic. Additionally, deploying network-level rate limiting can help mitigate the frequency of crafted requests attempting to trigger the vulnerability. Security teams should also ensure that monitoring tools are configured to detect abnormal spikes in error rates or resource consumption associated with this specific endpoint, enabling rapid detection and response to potential exploitation attempts.