CVE-2026-30073 in Free5GC
Summary
by MITRE • 08/27/2026
An issue in the NssaiAvailabilitySubscriptionCreate component of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/27/2026
The vulnerability identified within the free5GC open-source 5G core network implementation, specifically affecting version 4.0.1 and potentially earlier releases, resides in the NssaiAvailabilitySubscriptionCreate component. This function is responsible for handling requests from User Equipment or other network functions to subscribe to notifications regarding the availability of specific Network Slice Selection Assistance Information. The flaw allows an unauthenticated attacker to trigger a Denial of Service condition by submitting a specially crafted POST request that exploits improper input validation and resource management logic within this subscription creation mechanism.
From a technical perspective, the root cause lies in how the application processes incoming HTTP payloads associated with NSSAI availability subscriptions. When the server receives a malformed or excessively large payload designed to exploit memory allocation routines or infinite loops during parsing, it fails to release resources correctly or enters an unrecoverable state. This lack of robust error handling and boundary checking means that maliciously constructed data can exhaust system memory, CPU cycles, or connection pools associated with the subscription management service. Consequently, the affected component becomes unresponsive, effectively halting its ability to process legitimate traffic from other network entities such as AMF or SMF functions.
The operational impact of this vulnerability is significant within a 5G standalone architecture where free5GC serves as the control plane infrastructure. A successful exploitation results in the disruption of slice availability notifications, which are critical for dynamic network slicing operations. User equipment relying on these subscriptions may fail to receive updates about available slices, leading to service degradation or complete loss of connectivity for subscribers attempting to access specific network services. Furthermore, because this component is part of a core infrastructure module, its unavailability can cascade into broader system instability, affecting multiple dependent microservices and requiring manual intervention or restarts to restore normal operations, thereby increasing operational overhead and downtime costs.
This vulnerability aligns with CWE-400, which describes Uncontrolled Resource Consumption, as the attacker forces the application to consume excessive resources through crafted input. It also maps to MITRE ATT&CK technique T1499, Endpoint Denial of Service, specifically under the sub-category of resource exhaustion via service disruption. The attack vector is classified as Network-based with Low Complexity, indicating that an adversary can exploit this flaw remotely without requiring prior access or complex setup, provided they have network connectivity to the exposed API endpoints.
Mitigation strategies should focus on immediate patching and defensive configuration changes. Users running free5GC v4.0.1 are advised to upgrade to a patched version where input validation for NSSAI subscription requests has been strengthened. In environments where upgrading is not immediately feasible, implementing rate limiting on HTTP POST requests targeting the NssaiAvailabilitySubscriptionCreate endpoint can help mitigate resource exhaustion attacks. Additionally, deploying Web Application Firewalls with rules designed to detect anomalous payload sizes or malformed JSON structures associated with 5G core APIs can provide an additional layer of defense against exploitation attempts until a permanent fix is applied.