{"id":"EUVD-2026-32551","enisaUuid":"29a6813c-7bb9-3491-941f-3b2d0c77e88c","description":"free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC\u0027s PCF POST /npcf-policyauthorization/v1/app-sessions handler panics on a single authenticated request whose ascReqData.suppFeat \u003d\u003d \"1\" (enabling traffic-routing feature negotiation) and whose medComponents entries supply an afAppId but NO AfRoutReq. The create path then calls provisioningOfTrafficRoutingInfo(smPolicy, appID, routeReq, ...) with routeReq \u003d\u003d nil and dereferences routeReq.RouteToLocs (and other fields) without a nil check, causing runtime error: invalid memory address or nil pointer dereference. Gin recovery converts the panic into HTTP 500. This vulnerability is fixed in 4.2.2.","datePublished":"May 27, 2026, 3:50:18 PM","dateUpdated":"May 28, 2026, 2:46:12 PM","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/free5gc/free5gc/security/advisories/GHSA-wwqh-7jm5-gj7w\nhttps://github.com/free5gc/free5gc/issues/879\nhttps://github.com/free5gc/pcf/pull/65\nhttps://github.com/free5gc/pcf/commit/508d70b8527a6c8c923179dad450ea01e16b6aeb\n","aliases":"CVE-2026-44317\nGHSA-wwqh-7jm5-gj7w\n","assigner":"GitHub_M","epss":0.35,"enisaIdProduct":[{"id":"ff3b743b-8b42-38d2-9ca3-17eb45e2908f","product":{"name":"Free5GC","vendor":{"name":"Free5Gc"}},"product_version":"\u003c 4.2.2"}],"enisaIdVendor":[{"id":"ba630e9a-0e97-3878-ad19-7714050b65ae","vendor":{"name":"Free5Gc"}}],"enisaIdVulnerability":[{"id":"6636d982-ba4f-3b18-ba7f-5753dd8b3908","vulnerability":{"id":"GHSA-wwqh-7jm5-gj7w","description":"free5GC\u0027s PCF npcf-policyauthorization POST /app-sessions panics on suppFeat\u003d1 with missing AfRoutReq via nil pointer dereference","datePublished":"May 8, 2026, 10:40:11 PM","dateUpdated":"Jun 8, 2026, 11:47:08 PM","baseScore":0.0,"references":"https://github.com/free5gc/free5gc/security/advisories/GHSA-wwqh-7jm5-gj7w\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-44317\nhttps://github.com/free5gc/free5gc/issues/879\nhttps://github.com/free5gc/pcf/pull/65\nhttps://github.com/free5gc/pcf/commit/508d70b8527a6c8c923179dad450ea01e16b6aeb\nhttps://github.com/free5gc/free5gc\n","enisa_id":"EUVD-2026-32551\n","aliases":"CVE-2026-44317\nGHSA-wwqh-7jm5-gj7w\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:00:21 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"8af57335-e5a4-3e0e-bc61-847e69c31efc","vulnerability":{"id":"CVE-2026-44317","description":"free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC\u0027s PCF POST /npcf-policyauthorization/v1/app-sessions handler panics on a single authenticated request whose ascReqData.suppFeat \u003d\u003d \"1\" (enabling traffic-routing feature negotiation) and whose medComponents entries supply an afAppId but NO AfRoutReq. The create path then calls provisioningOfTrafficRoutingInfo(smPolicy, appID, routeReq, ...) with routeReq \u003d\u003d nil and dereferences routeReq.RouteToLocs (and other fields) without a nil check, causing runtime error: invalid memory address or nil pointer dereference. Gin recovery converts the panic into HTTP 500. This vulnerability is fixed in 4.2.2.","datePublished":"May 27, 2026, 3:50:18 PM","dateUpdated":"May 28, 2026, 2:46:12 PM","status":"PUBLISHED","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/free5gc/free5gc/security/advisories/GHSA-wwqh-7jm5-gj7w\nhttps://github.com/free5gc/free5gc/issues/879\nhttps://github.com/free5gc/pcf/pull/65\nhttps://github.com/free5gc/pcf/commit/508d70b8527a6c8c923179dad450ea01e16b6aeb\n","enisa_id":"EUVD-2026-32551\n","assigner":"GitHub_M","epss":0.35,"dataProcessed":"Nov 7, 2026, 7:21:46 AM","vulnerabilityProduct":[{"id":"c31d05d9-5ffa-330f-82cd-a77cf030ac39","product":{"name":"Free5GC","vendor":{"name":"Free5Gc"}},"product_version":"\u003c 4.2.2"}],"vulnerabilityVendor":[{"id":"8566fb47-fc5f-3d37-9d66-5d7b803a9040","vendor":{"name":"Free5Gc"}}]}}],"enisaIdAdvisory":[]}