{"id":"CVE-2026-44316","revision":null,"records":[{"revision":"40c1da8e98f942e0bcd3f5913ecbcfde","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-44316","aliases":[],"title":"free5GC: PCF npcf-smpolicycontrol POST /sm-policies panics on downstream UDR/OpenAPI 404 via nil pointer dereference","description":"free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's PCF POST /npcf-smpolicycontrol/v1/sm-policies handler (HandleCreateSmPolicyRequest) panics with a nil-pointer dereference when a downstream OpenAPI consumer call (UDR lookup) returns 404 Not Found and the consumer wrapper returns err != nil together with a nil response struct. The handler logs the OpenAPI error and continues executing instead of returning, then dereferences the nil response struct on a subsequent line and panics. Gin recovery converts the panic into HTTP 500, so a single attacker-shaped POST returns 500 instead of a clean 4xx whenever the downstream lookup fails. The PCF process keeps running. The trigger is a single POST containing input that causes the downstream UDR lookup to fail (e.g. an unknown DNN). In 4.2.1 this endpoint is also reachable WITHOUT an Authorization header because the PCF Npcf_SMPolicyControl route group is mounted without inbound auth middleware. This vulnerability is fixed in 4.2.2.","state":0,"publishedAt":"2026-05-27T15:52:07.224+00:00","modifiedAt":"2026-05-27T17:54:45.817+00:00","affected":[{"ecosystem":"Vendor product","name":"free5gc","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"free5gc\",\n                    \"product\": \"free5gc\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 4.2.2\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":"HIGH"}],"references":["https://github.com/free5gc/free5gc/security/advisories/GHSA-wr8j-6chw-gm6p","https://github.com/free5gc/free5gc/issues/803","https://github.com/free5gc/pcf/pull/62","https://github.com/free5gc/pcf/commit/df535f5524314620715e842baf9723efbeb481a7"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-44316","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-44316","identifiers":["CVE-2026-44316"]},"retained":false,"historicalAffected":[]},{"revision":"76ee41586347411a8c3832a801b8533f","observedAt":"2026-11-09T11:03:37.483+00:00","statement":{"source":"euvd","id":"EUVD-2026-32552","aliases":["CVE-2026-44316","GHSA-wr8j-6chw-gm6p"],"title":"free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's PCF POST /npcf-smpolicycontrol/v1/sm-policies handler (HandleCreateSmPolicyRequest) panics with a nil-pointer dereference when a downstream OpenAPI c…","description":"free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's PCF POST /npcf-smpolicycontrol/v1/sm-policies handler (HandleCreateSmPolicyRequest) panics with a nil-pointer dereference when a downstream OpenAPI consumer call (UDR lookup) returns 404 Not Found and the consumer wrapper returns err != nil together with a nil response struct. The handler logs the OpenAPI error and continues executing instead of returning, then dereferences the nil response struct on a subsequent line and panics. Gin recovery converts the panic into HTTP 500, so a single attacker-shaped POST returns 500 instead of a clean 4xx whenever the downstream lookup fails. The PCF process keeps running. The trigger is a single POST containing input that causes the downstream UDR lookup to fail (e.g. an unknown DNN). In 4.2.1 this endpoint is also reachable WITHOUT an Authorization header because the PCF Npcf_SMPolicyControl route group is mounted without inbound auth middleware. This vulnerability is fixed in 4.2.2.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":null}],"references":["https://github.com/free5gc/free5gc/security/advisories/GHSA-wr8j-6chw-gm6p","https://github.com/free5gc/free5gc/issues/803","https://github.com/free5gc/pcf/pull/62","https://github.com/free5gc/pcf/commit/df535f5524314620715e842baf9723efbeb481a7"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-32552","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"May 27, 2026, 3:52:07 PM","dateUpdated":"May 27, 2026, 5:54:45 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-32552","identifiers":["EUVD-2026-32552","CVE-2026-44316","GHSA-wr8j-6chw-gm6p"]},"retained":false,"historicalAffected":[]},{"revision":"ef4029f5ba004b8fba99f837a4556e87","observedAt":"2026-10-25T10:17:21.823+00:00","statement":{"source":"nvd","id":"CVE-2026-44316","aliases":[],"title":"free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's PCF POST /npcf-smpolicycontrol/v1/sm-policies handler (HandleCreateSmPolicyRequest) panics with a nil-pointer dereference when a downstream OpenAPI c…","description":"free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's PCF POST /npcf-smpolicycontrol/v1/sm-policies handler (HandleCreateSmPolicyRequest) panics with a nil-pointer dereference when a downstream OpenAPI consumer call (UDR lookup) returns 404 Not Found and the consumer wrapper returns err != nil together with a nil response struct. The handler logs the OpenAPI error and continues executing instead of returning, then dereferences the nil response struct on a subsequent line and panics. Gin recovery converts the panic into HTTP 500, so a single attacker-shaped POST returns 500 instead of a clean 4xx whenever the downstream lookup fails. The PCF process keeps running. The trigger is a single POST containing input that causes the downstream UDR lookup to fail (e.g. an unknown DNN). In 4.2.1 this endpoint is also reachable WITHOUT an Authorization header because the PCF Npcf_SMPolicyControl route group is mounted without inbound auth middleware. This vulnerability is fixed in 4.2.2.","state":0,"publishedAt":"2026-05-27T17:16:36.57+00:00","modifiedAt":"2026-10-14T20:10:00.19+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":"HIGH"}],"references":["https://github.com/free5gc/free5gc/issues/803","https://github.com/free5gc/free5gc/security/advisories/GHSA-wr8j-6chw-gm6p","https://github.com/free5gc/pcf/commit/df535f5524314620715e842baf9723efbeb481a7","https://github.com/free5gc/pcf/pull/62"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44316","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Analyzed","weaknesses":["CWE-476","CWE-754"],"productCriteria":["cpe:2.3:a:free5gc:free5gc:*:*:*:*:*:*:*:*"],"sourceDates":{"published":"2026-05-27T17:16:36.570","lastModified":"2026-10-14T20:10:00.190"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-44316","identifiers":["CVE-2026-44316"]},"retained":false,"historicalAffected":[]},{"revision":"a2a20cd2ec164abbb0044b2e19769779","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-wr8j-6chw-gm6p","aliases":["CVE-2026-44316","GO-2026-5720"],"title":"free5GC's PCF npcf-smpolicycontrol POST /sm-policies panics on downstream UDR/OpenAPI 404 via nil pointer dereference","description":"### Summary\nfree5GC's PCF `POST /npcf-smpolicycontrol/v1/sm-policies` handler (`HandleCreateSmPolicyRequest`) panics with a nil-pointer dereference when a downstream OpenAPI consumer call (UDR lookup) returns `404 Not Found` and the consumer wrapper returns `err != nil` together with a nil response struct. The handler logs the OpenAPI error and continues executing instead of returning, then dereferences the nil response struct on a subsequent line and panics. Gin recovery converts the panic into `HTTP 500`, so a single attacker-shaped POST returns 500 instead of a clean 4xx whenever the downstream lookup fails. The PCF process keeps running.\n\nThe trigger is a single POST containing input that causes the downstream UDR lookup to fail (e.g. an unknown DNN). In v4.2.1 this endpoint is also reachable WITHOUT an `Authorization` header because the PCF `Npcf_SMPolicyControl` route group is mounted without inbound auth middleware (see free5gc/free5gc#844). So in the validation lab the trigger is fully unauthenticated.\n\n### Details\nValidated against the PCF container in the official Docker compose lab.\n- free5GC version: `v4.1.0` (originally reported on v4.1.0; same defect present in v4.2.1)\n- PCF endpoint: `http://10.100.200.9:8000`\n\nVulnerable handler path (paraphrased from the captured stack trace):\n```\n[INFO][PCF][SMpolicy] Handle CreateSmPolicy\n[ERRO][PCF][Consumer] openapi error: 404, Not Found\n[ERRO][PCF][GIN] panic: runtime error: invalid memory address or nil pointer dereference\n  github.com/free5gc/pcf/internal/sbi/processor.(*Processor).HandleCreateSmPolicyRequest\n      /go/src/free5gc/NFs/pcf/internal/sbi/processor/smpolicy.go:82 +0x562\n  github.com/free5gc/pcf/internal/sbi.(*Server).HTTPCreateSMPolicy\n      /go/src/free5gc/NFs/pcf/internal/sbi/api_smpolicy.go:86 +0x405\n```\n\nThe handler's UDR-failure branch logs the OpenAPI error but does not return; the next line dereferences the nil response struct.\n\nCode evidence (paths in `free5gc/pcf`):\n- Panic site:\n  - `NFs/pcf/internal/sbi/processor/smpolicy.go:82`\n- Route dispatch:\n  - `NFs/pcf/internal/sbi/api_smpolicy.go:86`\n\n### PoC\nReproduced end-to-end against the running PCF at `http://10.100.200.9:8000`.\n\nSend a single POST whose `dnn` is unknown to UDR -- this drives the downstream OpenAPI call to return `404 Not Found`, which then triggers the nil-deref panic:\n```\ncurl -sS -X POST 'http://10.100.200.9:8000/npcf-smpolicycontrol/v1/sm-policies' \\\n  -H 'Content-Type: application/json' \\\n  -d '{\n    \"supi\":\"imsi-208930000000003\",\n    \"pduSessionId\":1,\n    \"dnn\":\"internet-bad\",\n    \"sliceInfo\":{\"sst\":1,\"sd\":\"010203\"},\n    \"servingNetwork\":{\"mcc\":\"208\",\"mnc\":\"93\"},\n    \"accessType\":\"3GPP_ACCESS\",\n    \"notificationUri\":\"http://smf.free5gc.org:8000/npcf-smpolicycontrol/v1/notify\"\n  }'\n```\n\nObserved response: `HTTP 500 Internal Server Error` with empty body.\n\nPCF container logs show:\n```\n[INFO][PCF][SMpolicy] Handle CreateSmPolicy\n[ERRO][PCF][Consumer] openapi error: 404, Not Found\n[ERRO][PCF][GIN] panic: runtime error: invalid memory address or nil pointer dereference\n  ...HandleCreateSmPolicyRequest at smpolicy.go:82...\n```\n\nThe Gin recovery middleware catches the panic (the captured stack trace runs inside `ginRecover.func2.1`), so the PCF process keeps serving other requests; the realized impact is per-request `HTTP 500` on this endpoint whenever the downstream lookup fails.\n\n### Impact\nNULL pointer dereference (CWE-476) caused by improper handling of an exceptional branch (CWE-754): the UDR-failure branch logs the OpenAPI error but does not return, then dereferences the nil response struct. The intended behavior is to return a controlled `4xx`/`5xx` `ProblemDetails` and stop processing.\n\nGin recovery catches the panic, so the PCF process is NOT killed and other endpoints continue serving. The realized impact is per-request: any unauthenticated POST that drives the downstream UDR lookup to a `404` returns `HTTP 500` (with empty body and a stack trace in PCF logs) instead of a controlled error response.\n\nNo Confidentiality impact (the response is `500` with empty body). No persistent Integrity impact (the panic happens before any state mutation). Availability impact is limited to per-request degradation. The endpoint remains reachable to unauthenticated attackers via the route-group auth gap separately tracked in free5gc/free5gc#844.\n\nAffected: free5gc v4.2.1 (originally reported against v4.1.0; same defect present).\n\nUpstream issue: https://github.com/free5gc/free5gc/issues/803\nUpstream fix: https://github.com/free5gc/pcf/pull/62","state":0,"publishedAt":"2026-05-08T22:39:43+00:00","modifiedAt":"2026-06-25T23:11:02.5079623+00:00","affected":[{"ecosystem":"Go","name":"github.com/free5gc/pcf","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.4.2"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/free5gc/free5gc/security/advisories/GHSA-wr8j-6chw-gm6p","https://nvd.nist.gov/vuln/detail/CVE-2026-44316","https://github.com/free5gc/free5gc/issues/803","https://github.com/free5gc/pcf/pull/62","https://github.com/free5gc/pcf/commit/df535f5524314620715e842baf9723efbeb481a7","https://github.com/free5gc/free5gc"],"sourceUrl":"https://github.com/advisories/GHSA-wr8j-6chw-gm6p","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-wr8j-6chw-gm6p","identifiers":["GHSA-wr8j-6chw-gm6p","CVE-2026-44316","GO-2026-5720"]},"retained":false,"historicalAffected":[]},{"revision":"f31e76efc2ce4973881c719a62c8ba3e","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-5720","aliases":["CVE-2026-44316","GHSA-wr8j-6chw-gm6p"],"title":"free5GC's PCF npcf-smpolicycontrol POST /sm-policies panics on downstream UDR/OpenAPI 404 via nil pointer dereference in github.com/free5gc/pcf","description":"free5GC's PCF npcf-smpolicycontrol POST /sm-policies panics on downstream UDR/OpenAPI 404 via nil pointer dereference in github.com/free5gc/pcf","state":0,"publishedAt":"2026-06-25T22:34:38+00:00","modifiedAt":"2026-06-25T23:01:29.5671734+00:00","affected":[{"ecosystem":"Go","name":"github.com/free5gc/pcf","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.4.2"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/free5gc/free5gc/security/advisories/GHSA-wr8j-6chw-gm6p","https://nvd.nist.gov/vuln/detail/CVE-2026-44316","https://github.com/free5gc/pcf/commit/df535f5524314620715e842baf9723efbeb481a7","https://github.com/free5gc/pcf/pull/62","https://github.com/free5gc/free5gc/issues/803"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-5720","license":"OSV · upstream source license applies","key":"osv:GO-2026-5720","identifiers":["GO-2026-5720","CVE-2026-44316","GHSA-wr8j-6chw-gm6p"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-09T23:04:35.5115198+00:00","complete":true,"records":1773,"lastAttemptAt":"2026-11-09T23:04:35.5115198+00:00","lastSuccessAt":"2026-11-09T23:04:35.7199619+00:00","error":null,"lastVerifiedAt":"2026-11-09T23:04:35.7199622+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-24e6fde7b744113daefb8f6135035fb8a5c69c9617c9c0d40574a0376532ffd3-dd2a77f649768340b3da193d98d597fa46c17d01cc081b31103212155ce6cd5d","complete":true,"records":421715,"lastAttemptAt":"2026-11-09T23:02:22.2942221+00:00","lastSuccessAt":"2026-11-09T23:02:22.1588494+00:00","error":null,"lastVerifiedAt":"2026-11-09T23:02:22.2942221+00:00","snapshotPublishedAt":"2026-11-09T22:27:08+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-47ea30d05491460caa5ce44b8cba58f9","complete":false,"records":13686,"lastAttemptAt":"2026-11-09T23:17:21.9523007+00:00","lastSuccessAt":"2026-11-09T23:17:21.948+00:00","error":"35 identifier lookups failed; latest failures include HTTP 403. Other identifiers were checked independently.","lastVerifiedAt":"2026-11-09T23:17:21.948+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13669,"expectedIdentifiers":13739,"failedIdentifiers":35},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-09T23:04:35.5115198+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-09T23:04:35.5115198+00:00","lastSuccessAt":"2026-11-09T23:04:35.7206951+00:00","error":null,"lastVerifiedAt":"2026-11-09T23:04:35.7206952+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-adb512372f6d42c7b17c6efd528c7d57","complete":false,"records":13692,"lastAttemptAt":"2026-11-09T23:05:02.0476605+00:00","lastSuccessAt":"2026-11-09T23:05:02.041+00:00","error":null,"lastVerifiedAt":"2026-11-09T23:05:02.041+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13704,"expectedIdentifiers":13739,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-f16b02cc2b44d5413157015d03b8f1bf0217fdb477438e8f5866bcf35b179abd","complete":true,"records":9930,"lastAttemptAt":"2026-11-09T23:04:35.3476978+00:00","lastSuccessAt":"2026-11-09T23:04:34.9543246+00:00","error":null,"lastVerifiedAt":"2026-11-09T23:04:35.3476978+00:00","snapshotPublishedAt":"2026-11-09T23:03:07+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-26503967ae4379db8f374089589d6e03fb15bd31f820c9e992aaf93840c2236c","complete":true,"records":1971,"lastAttemptAt":"2026-11-09T23:02:22.4504307+00:00","lastSuccessAt":"2026-11-09T21:02:20.472473+00:00","error":null,"lastVerifiedAt":"2026-11-09T23:02:22.4504307+00:00","snapshotPublishedAt":"2026-11-09T20:18:18+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-761ecc9061239b0da572dc9254c6f384c1d19339eb08408c436647a2f26129e9","complete":true,"records":3064,"lastAttemptAt":"2026-11-09T23:04:35.4661135+00:00","lastSuccessAt":"2026-11-09T17:05:03.4044794+00:00","error":null,"lastVerifiedAt":"2026-11-09T23:04:35.4661135+00:00","snapshotPublishedAt":"2026-11-09T16:33:20+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-fe5caa127af053959ad6ee208ca92e895a6f5d3c14202fe035925df5f35ffed2","complete":true,"records":231329,"lastAttemptAt":"2026-11-09T23:04:24.8967882+00:00","lastSuccessAt":"2026-11-09T23:04:23.4601156+00:00","error":null,"lastVerifiedAt":"2026-11-09T23:04:24.8967882+00:00","snapshotPublishedAt":"2026-11-09T22:48:12+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}