{"id":"CVE-2026-44319","sourceIdentifier":"security-advisories@github.com","published":"2026-05-27T17:16:37.033","lastModified":"2026-10-14T20:10:00.190","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's NEF terminates the entire process when a stored PFD-subscription notifyUri cannot be reached. In PfdChangeNotifier.FlushNotifications(), the notifier calls NnefPFDmanagementNotify(...) and on any delivery error invokes logger.PFDManageLog.Fatal(err), which is os.Exit(1)-equivalent in Go. An attacker who can create a PFD subscription with an attacker-chosen notifyUri and then trigger a PFD change can deterministically kill NEF on the asynchronous delivery attempt -- the process exits with status 1, dropping NEF's entire SBI surface until restart. This vulnerability is fixed in 4.2.2."},{"lang":"es","value":"free5GC es una implementación de código abierto de la red central 5G. Antes de la versión 4.2.2, el NEF de free5GC termina todo el proceso cuando no se puede alcanzar un notifyUri de suscripción PFD almacenado. En PfdChangeNotifier.FlushNotifications(), el notificador llama a NnefPFDmanagementNotify(...) y ante cualquier error de entrega invoca logger.PFDManageLog.Fatal(err), que es equivalente a os.Exit(1) en Go. Un atacante que puede crear una suscripción PFD con un notifyUri elegido por el atacante y luego desencadenar un cambio de PFD puede terminar el NEF de forma determinista en el intento de entrega asíncrona -- el proceso sale con estado 1, interrumpiendo toda la superficie SBI del NEF hasta el reinicio. Esta vulnerabilidad está corregida en la versión 4.2.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"free5gc","product":"free5gc","versions":[{"version":"< 4.2.2","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-05-28T14:15:45.991017Z","id":"CVE-2026-44319","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-20"},{"lang":"en","value":"CWE-617"},{"lang":"en","value":"CWE-755"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:free5gc:free5gc:*:*:*:*:*:*:*:*","versionEndExcluding":"4.2.2","matchCriteriaId":"EF7EBB95-EB4E-44C5-BF0A-9C99B0A7775F"}]}]}],"references":[{"url":"https://github.com/free5gc/free5gc/issues/924","source":"security-advisories@github.com","tags":["Exploit","Issue Tracking"]},{"url":"https://github.com/free5gc/free5gc/security/advisories/GHSA-rxrq-fv76-26pr","source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"]},{"url":"https://github.com/free5gc/nef/commit/f110517b1189801950b50668a593398687049074","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/free5gc/nef/pull/25","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/free5gc/free5gc/issues/924","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Issue Tracking"]},{"url":"https://github.com/free5gc/free5gc/security/advisories/GHSA-rxrq-fv76-26pr","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Vendor Advisory"]}]}