{"id":"CVE-2026-44318","sourceIdentifier":"security-advisories@github.com","published":"2026-05-27T17:16:36.887","lastModified":"2026-10-14T20:10:00.190","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's BSF PUT /nbsf-management/v1/subscriptions/{subId} handler has an unsynchronized write on the global Subscriptions map. The handler first reads the map under RLock() via BSFContext.GetSubscription(subId), but if the subscription does not exist, ReplaceIndividualSubcription() writes back to the same map directly without taking the mutex (bsfContext.BsfSelf.Subscriptions[subId] = subscription). Under concurrent authenticated PUT load, one goroutine can read while another writes the map, which causes the Go runtime to abort the process with fatal error: concurrent map read and map write (Go runtime panics that come from concurrent map access bypass recover() and terminate the process). The BSF container exits with code 2 -- the entire BSF SBI surface goes down until restart. This vulnerability is fixed in 4.2.2."},{"lang":"es","value":"free5GC es una implementación de código abierto de la red central 5G. Antes de la versión 4.2.2, el gestor BSF PUT /nbsf-management/v1/subscriptions/{subId} de free5GC tiene una escritura no sincronizada en el mapa global de Subscriptions. El gestor primero lee el mapa bajo RLock() a través de BSFContext.GetSubscription(subId), pero si la suscripción no existe, ReplaceIndividualSubcription() escribe de nuevo en el mismo mapa directamente sin tomar el mutex (bsfContext.BsfSelf.Subscriptions[subId] = subscription). Bajo una carga PUT autenticada concurrente, una goroutine puede leer mientras otra escribe en el mapa, lo que hace que el tiempo de ejecución de Go aborte el proceso con un error fatal: lectura y escritura concurrente de mapa (los panics del tiempo de ejecución de Go que provienen del acceso concurrente al mapa evitan recover() y terminan el proceso). El contenedor BSF sale con código 2 -- toda la superficie SBI del BSF se cae hasta el reinicio. Esta vulnerabilidad se corrige en la versión 4.2.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"free5gc","product":"free5gc","versions":[{"version":"< 4.2.2","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-05-27T17:34:59.963720Z","id":"CVE-2026-44318","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-362"},{"lang":"en","value":"CWE-820"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:free5gc:free5gc:*:*:*:*:*:*:*:*","versionEndExcluding":"4.2.2","matchCriteriaId":"EF7EBB95-EB4E-44C5-BF0A-9C99B0A7775F"}]}]}],"references":[{"url":"https://github.com/free5gc/bsf/commit/277908565fd628d974a13ef562b81a8b7b519ffa","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/free5gc/bsf/pull/7","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/free5gc/free5gc/issues/926","source":"security-advisories@github.com","tags":["Exploit","Issue Tracking"]},{"url":"https://github.com/free5gc/free5gc/security/advisories/GHSA-27ph-8q4f-h7m7","source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"]},{"url":"https://github.com/free5gc/free5gc/issues/926","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Issue Tracking"]},{"url":"https://github.com/free5gc/free5gc/security/advisories/GHSA-27ph-8q4f-h7m7","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Vendor Advisory"]}]}