CVE-2026-75439 in Free5GC
Summary
by MITRE • 09/05/2026
An issue in Free5GC v.4.2.2 allows a remote attacker to cause a denial of service via the UPF component
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/05/2026
The vulnerability identified within Free5GC version 4.2.2 specifically targets the User Plane Function, which serves as the critical data forwarding element in the 5G core network architecture. This component is responsible for routing user traffic between the radio access network and external packet data networks, making it a high-value target for adversaries seeking to disrupt telecommunications services. The flaw resides within the UPF implementation, allowing an unauthenticated or remote attacker to trigger conditions that lead to service degradation or complete outage. By exploiting this weakness, an adversary can send specially crafted packets or requests that overwhelm system resources such as memory, CPU cycles, or connection tables, thereby preventing legitimate users from accessing network services. This type of attack directly impacts the availability pillar of information security and can result in significant operational downtime for mobile network operators relying on Free5GC deployments.
From a technical perspective, denial-of-service vulnerabilities often stem from improper input validation, resource management errors, or infinite loops triggered by malformed data structures. In the context of 5G core networks, the UPF processes vast amounts of signaling and user plane traffic using protocols such as GTP-U (GPRS Tunnelling Protocol - User Plane). If the implementation fails to adequately sanitize incoming packets or correctly handle edge cases in packet parsing, an attacker can exploit these gaps. For instance, a malformed header field might cause the application to enter a state where it continuously retries processing or allocates excessive memory without releasing it. This leads to resource exhaustion, causing the UPF process to crash or become unresponsive. Such behavior effectively halts data transmission for all connected devices within the affected network slice or cell sector, creating a widespread service interruption that is difficult to mitigate in real-time due to the distributed nature of 5G infrastructure.
The operational impact of this vulnerability extends beyond simple connectivity loss. In modern telecommunications environments where services like emergency calling, IoT communications, and critical industrial automation rely on low-latency and high-availability networks, such disruptions can have severe consequences. Attackers may leverage this flaw as part of a broader campaign to destabilize network infrastructure or as a distraction technique while attempting other malicious activities elsewhere in the system. The ability to remotely trigger these conditions without authentication highlights a significant security gap in the default configurations or codebase of Free5GC v4.2.2, emphasizing the need for rigorous stress testing and fuzzing during development cycles. Network operators must recognize that open-source core network components require careful hardening before deployment in production environments to prevent exploitation by state-sponsored actors or cybercriminals seeking to cause economic damage or societal disruption.
To mitigate this risk, immediate action should focus on applying available patches from the Free5GC maintainers if a fixed version has been released for v4.2.2. In cases where patching is not immediately feasible, network administrators can implement defensive measures at the perimeter level by deploying deep packet inspection firewalls or intrusion prevention systems configured to detect and block anomalous GTP-U traffic patterns associated with resource exhaustion attacks. Rate limiting on UPF ingress interfaces can also help mitigate the impact of volumetric attacks derived from this vulnerability. Furthermore, organizations should conduct thorough security assessments including static application security testing and dynamic analysis to identify similar flaws in other components of their 5G core deployment. Adhering to industry standards such as CWE-400 for uncontrolled resource consumption and aligning with MITRE ATT&CK techniques related to service exhaustion will help in structuring a robust defense strategy against both this specific vulnerability and analogous threats targeting cloud-native telecommunications infrastructure.