Free5GC up to 1.4.1 NRF Service EncodeGroupId access control

Summaryinfo

A vulnerability marked as critical has been reported in Free5GC up to 1.4.1. Affected by this issue is the function EncodeGroupId of the component NRF Service. The manipulation leads to access control. This vulnerability is listed as CVE-2026-33062. The attack may be initiated remotely. There is no available exploit. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Free5GC up to 1.4.1. This issue affects the function EncodeGroupId of the component NRF Service. The manipulation with an unknown input leads to a access control vulnerability. Using CWE to declare the problem leads to CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. Impacted is availability. The summary by CVE is:

free5GC is an open source 5G core network. free5GC NRF prior to version 1.4.2 has an Improper Input Validation vulnerability leading to Denial of Service. All deployments of free5GC using the NRF discovery service are affected. The `EncodeGroupId` function attempts to access array indices [0], [1], [2] without validating the length of the split data. When the parameter contains insufficient separator characters, the code panics with "index out of range". A remote attacker can cause the NRF service to panic and crash by sending a crafted HTTP GET request with a malformed `group-id-list` parameter. This results in complete denial of service for the NRF discovery service. free5GC NRF version 1.4.2 fixes the issue. There is no direct workaround at the application level. The recommendation is to apply the provided patch or restrict access to the NRF API to trusted sources only.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-33062 since 03/17/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1068 according to MITRE ATT&CK.

Upgrading to version 1.4.2 eliminates this vulnerability. Applying the patch dac77d8f8f2e0f041c5634fb3c685dcb9734b872 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Name

• Free5GC

Version

• 1.4.0
• 1.4.1

License

• open-source

Website

• Product: https://github.com/free5gc/free5gc/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion