Free5GC up to 4.2.1 amf-subscriptions type conversion

Summaryinfo

A vulnerability marked as problematic has been reported in Free5GC up to 4.2.1. This issue affects some unknown processing of the file /subscription-data/{ueId}/{servingPlmnId}/ee-subscriptions/{subsId}/amf-subscriptions. Performing a manipulation results in type conversion. This vulnerability is reported as CVE-2026-44324. The attack is possible to be carried out remotely. No exploit exists. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Free5GC up to 4.2.1. This affects an unknown code of the file /subscription-data/{ueId}/{servingPlmnId}/ee-subscriptions/{subsId}/amf-subscriptions. The manipulation with an unknown input leads to a type conversion vulnerability. CWE is classifying the issue as CWE-704. The product does not correctly convert an object, resource, or structure from one type to a different type. This is going to have an impact on availability. The summary by CVE is:

free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's UDR nudr-dr DELETE /subscription-data/{ueId}/{servingPlmnId}/ee-subscriptions/{subsId}/amf-subscriptions handler panics on a single authenticated request against a fresh UDR instance when the supplied ueId does not exist in UESubsCollection. The processor checks value, ok := udrSelf.UESubsCollection.Load(ueId) and sets a 404 USER_NOT_FOUND problem-details on the miss path, but execution continues and immediately runs value.(*udr_context.UESubsData) -- a Go type assertion on a nil interface, which panics with interface conversion: interface {} is nil, not *context.UESubsData. Gin recovery converts the panic into HTTP 500, but the endpoint remains repeatedly panicable. This vulnerability is fixed in 4.2.2.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-44324 since 05/05/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 4.2.2 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Name

• Free5GC

Version

• 4.2.0
• 4.2.1

Website

• Product: https://github.com/free5gc/free5gc/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion