Free5GC up to 1.2.1 CHF SBI Interface recharging array index

Summaryinfo

A vulnerability identified as problematic has been detected in Free5GC up to 1.2.1. Affected is an unknown function of the file /nchf-convergedcharging/v3/recharging/ of the component CHF SBI Interface. Performing a manipulation results in array index. This vulnerability is identified as CVE-2026-32937. The attack can be initiated remotely. There is not any exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic has been found in Free5GC up to 1.2.1. This affects some unknown functionality of the file /nchf-convergedcharging/v3/recharging/ of the component CHF SBI Interface. The manipulation with an unknown input leads to a array index vulnerability. CWE is classifying the issue as CWE-129. The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array. This is going to have an impact on availability. The summary by CVE is:

free5GC is an open source 5G core network. free5GC CHF prior to version 1.2.2 has an out-of-bounds slice access vulnerability in the CHF `nchf-convergedcharging` service. A valid authenticated request to PUT `/nchf-convergedcharging/v3/recharging/:ueId?ratingGroup=...` can trigger a server-side panic in `github.com/free5gc/chf/internal/sbi.(*Server).RechargePut(...)` due to an out-of-range slice access. In the reported runtime, Gin recovery converts the panic into HTTP 500, but the recharge path remains remotely panic-triggerable and can be abused repeatedly to degrade recharge functionality and flood logs. In deployments without equivalent recovery handling, this panic may cause more severe service disruption. free5GC CHF patches the issue. Some workarounds are available: Restrict access to the `nchf-convergedcharging` recharge endpoint to strictly trusted NF callers only; apply rate limiting or network ACLs in front of the CHF SBI interface to reduce repeated panic-trigger attempts; if the recharge API is not required, temporarily disable or block external reachability to this route; and/or ensure panic recovery, monitoring, and alerting are enabled.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-32937 since 03/17/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details are known, but no exploit is available.

Upgrading to version 1.2.2 eliminates this vulnerability. Applying the patch 55af766f321a00afa978e806548c96f8a7d2433e is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Name

• Free5GC

Version

• 1.2.0
• 1.2.1

License

• open-source

Website

• Product: https://github.com/free5gc/free5gc/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion