CVE-2026-30072 in free5GC
Summary
by MITRE • 08/27/2026
A NULL pointer dereference in the CDR processing path of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via supplying crafted payload.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/27/2026
The vulnerability identified in free5GC version 4.0.1 represents a critical memory management flaw within the Control and Data Recording, or CDR processing subsystem. This component is responsible for aggregating usage data from network functions to facilitate billing and analytics operations within a 5G standalone core network architecture. The specific technical defect involves an improper validation of input parameters before they are dereferenced by the application logic. When the system processes incoming signaling messages related to session management or policy control, it attempts to access memory addresses associated with CDR records without first verifying that these pointers contain valid, non-null values. This lack of defensive programming allows a remote attacker who can inject crafted payloads into the communication stream between network functions to trigger an invalid memory access event.
From a technical perspective, this flaw is classified under CWE-476, which denotes NULL Pointer Dereference vulnerabilities. The operational mechanism relies on the fact that in many programming environments, particularly those written in C or Go with unsafe pointer operations, accessing a null address results in a segmentation fault or an immediate termination of the process by the operating system's kernel. In the context of free5GC, which is often deployed as a containerized microservice architecture, this crash causes the specific network function instance handling the request to terminate unexpectedly. Because CDR processing is integral to maintaining state and logging for ongoing sessions, such a failure can disrupt not only the immediate transaction but also potentially affect related services that depend on consistent data availability or continuous operation of the control plane components.
The impact of this vulnerability extends beyond simple service interruption. A successful exploitation allows an attacker with network access to the affected interface to cause a Denial of Service against the free5GC instance. This can lead to significant operational disruptions, including the inability for user equipment to establish new sessions or maintain existing ones if the crash affects critical control plane functions like the Session Management Function or Policy Control Function. Furthermore, in open-source 5G core deployments often used for testing and development environments that may be exposed to broader networks, this vulnerability poses a risk of service degradation that could impact downstream applications relying on consistent connectivity metrics. The attacker does not require authentication if they can reach the vulnerable API endpoints, making it particularly dangerous in unsecured or misconfigured testbeds.
Mitigation strategies for this issue primarily involve applying vendor-provided patches that update free5GC to a version where input validation is strictly enforced before pointer dereferencing occurs. Developers should ensure that all external inputs are sanitized and validated against expected schemas prior to processing. For organizations unable to immediately patch, network segmentation can provide temporary relief by restricting access to the affected interfaces from untrusted networks. Additionally, implementing robust monitoring and alerting for process restarts or abnormal termination signals in container orchestration platforms like Kubernetes can help detect exploitation attempts quickly. It is also advisable to review deployment configurations to ensure that CDR processing services are not exposed directly to public-facing endpoints without proper authentication and rate-limiting controls, thereby reducing the attack surface available to potential adversaries seeking to disrupt 5G core operations.