free5GC up to 1.4.4 AUSF ue_authentication.go AddAusfUeContextToPool SUPI race condition

Summaryinfo

A vulnerability marked as problematic has been reported in free5GC up to 1.4.4. Affected is the function AddAusfUeContextToPool of the file internal/sbi/processor/ue_authentication.go of the component AUSF. This manipulation of the argument SUPI causes race condition. This vulnerability is tracked as CVE-2026-55784. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability has been found in free5GC up to 1.4.4 and classified as problematic. Affected by this vulnerability is the function AddAusfUeContextToPool of the file internal/sbi/processor/ue_authentication.go of the component AUSF. The manipulation of the argument SUPI with an unknown input leads to a race condition vulnerability. The CWE definition for the vulnerability is CWE-362. The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently. As an impact it is known to affect availability. The summary by CVE is:

free5GC is an open-source implementation of the 5G core network. In version 1.4.4 and earlier, the AUSF component stores per-subscriber authentication state in a global sync.Map named AUSFContext.UePool in internal/context/context.go, keyed only by SUPI. Every request handled by internal/sbi/processor/ue_authentication.go creates an AusfUeContext, and AddAusfUeContextToPool executes ausfContext.UePool.Store(ausfUeContext.Supi, ausfUeContext), unconditionally replacing the active context for that SUPI. An attacker with access to the AUSF SBI/N12 interface can send concurrent POST /nausf-auth/v1/ue-authentications requests for the same target SUPI, causing all attempts to share one logical authentication context URL while K_aut, XRES, and EapID are repeatedly overwritten. A valid EAP-AKA' response for an earlier challenge is then checked against the latest context, causing AT_MAC verification to fail and denying authentication to the selected subscriber while the request flood continues. No fixed version is available as of this review.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-55784 since 06/17/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details of the vulnerability are known, but there is no available exploit.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Name

• free5GC

Version

• 1.4.0
• 1.4.1
• 1.4.2
• 1.4.3
• 1.4.4

Website

• Product: https://github.com/free5gc/free5gc/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion