{"id":"EUVD-2026-32575","enisaUuid":"1baebc09-e22e-35d1-b890-65b7561f0f07","description":"free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC\u0027s UDR nudr-dr DELETE /subscription-data/{ueId}/{servingPlmnId}/ee-subscriptions/{subsId}/amf-subscriptions handler contains a nil-pointer dereference reachable from a single authenticated request, after one preparatory authenticated EE-subscription create. The handler checks _, ok \u003d UESubsData.EeSubscriptionCollection[subsId] and sets a 404 problem-details on the miss path, but then continues to UESubsData.EeSubscriptionCollection[subsId].AmfSubscriptionInfos -- dereferencing the same missing entry instead of returning. Gin recovery converts the panic into HTTP 500, but the endpoint remains repeatedly panicable. This vulnerability is fixed in 4.2.2.","datePublished":"May 27, 2026, 3:45:14 PM","dateUpdated":"Jun 1, 2026, 5:08:45 PM","baseScore":4.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","references":"https://github.com/free5gc/free5gc/security/advisories/GHSA-4rqf-grm6-vf75\nhttps://github.com/free5gc/free5gc/issues/919\nhttps://github.com/free5gc/udr/pull/60\nhttps://github.com/free5gc/udr/commit/8a1d3c63be99d378806d771f086ff32f1867da99\n","aliases":"CVE-2026-44323\nGHSA-4rqf-grm6-vf75\n","assigner":"GitHub_M","epss":0.35,"enisaIdProduct":[{"id":"0e86671f-9f14-3e4c-ba9c-6e84c3b30798","product":{"name":"Free5GC","vendor":{"name":"Free5Gc"}},"product_version":"\u003c 4.2.2"}],"enisaIdVendor":[{"id":"4b9fe97a-1ce2-3438-a716-943fac7e7901","vendor":{"name":"Free5Gc"}}],"enisaIdVulnerability":[{"id":"74e45b63-a057-36f4-baa4-3a70384948e2","vulnerability":{"id":"GHSA-4rqf-grm6-vf75","description":"free5GC\u0027s UDR nudr-dr DELETE amf-subscriptions panics on missing subsId when UE state exists (nil pointer dereference)","datePublished":"May 8, 2026, 10:52:00 PM","dateUpdated":"Jun 8, 2026, 11:48:05 PM","baseScore":0.0,"references":"https://github.com/free5gc/free5gc/security/advisories/GHSA-4rqf-grm6-vf75\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-44323\nhttps://github.com/free5gc/free5gc/issues/919\nhttps://github.com/free5gc/udr/pull/60\nhttps://github.com/free5gc/udr/commit/8a1d3c63be99d378806d771f086ff32f1867da99\nhttps://github.com/free5gc/free5gc\n","enisa_id":"EUVD-2026-32575\n","aliases":"GHSA-4rqf-grm6-vf75\nCVE-2026-44323\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:50 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"83e5bf14-236d-3ec1-a43e-327c1c2f62db","vulnerability":{"id":"CVE-2026-44323","description":"free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC\u0027s UDR nudr-dr DELETE /subscription-data/{ueId}/{servingPlmnId}/ee-subscriptions/{subsId}/amf-subscriptions handler contains a nil-pointer dereference reachable from a single authenticated request, after one preparatory authenticated EE-subscription create. The handler checks _, ok \u003d UESubsData.EeSubscriptionCollection[subsId] and sets a 404 problem-details on the miss path, but then continues to UESubsData.EeSubscriptionCollection[subsId].AmfSubscriptionInfos -- dereferencing the same missing entry instead of returning. Gin recovery converts the panic into HTTP 500, but the endpoint remains repeatedly panicable. This vulnerability is fixed in 4.2.2.","datePublished":"May 27, 2026, 3:45:14 PM","dateUpdated":"Jun 1, 2026, 5:08:45 PM","status":"PUBLISHED","baseScore":4.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","references":"https://github.com/free5gc/free5gc/security/advisories/GHSA-4rqf-grm6-vf75\nhttps://github.com/free5gc/free5gc/issues/919\nhttps://github.com/free5gc/udr/pull/60\nhttps://github.com/free5gc/udr/commit/8a1d3c63be99d378806d771f086ff32f1867da99\n","enisa_id":"EUVD-2026-32575\n","assigner":"GitHub_M","epss":0.35,"dataProcessed":"Oct 30, 2026, 7:17:58 AM","vulnerabilityProduct":[{"id":"c8f9acb8-ae21-3c0d-b8c4-3fab8a8592eb","product":{"name":"Free5GC","vendor":{"name":"Free5Gc"}},"product_version":"\u003c 4.2.2"}],"vulnerabilityVendor":[{"id":"7d4f3bbe-4519-3fdb-9be7-cb5afb81470e","vendor":{"name":"Free5Gc"}}]}}],"enisaIdAdvisory":[]}