{"id":"EUVD-2026-32579","enisaUuid":"45120432-93a4-34ac-8ae8-6425e853b38a","description":"free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC\u0027s NEF terminates the entire process when a stored PFD-subscription notifyUri cannot be reached. In PfdChangeNotifier.FlushNotifications(), the notifier calls NnefPFDmanagementNotify(...) and on any delivery error invokes logger.PFDManageLog.Fatal(err), which is os.Exit(1)-equivalent in Go. An attacker who can create a PFD subscription with an attacker-chosen notifyUri and then trigger a PFD change can deterministically kill NEF on the asynchronous delivery attempt -- the process exits with status 1, dropping NEF\u0027s entire SBI surface until restart. This vulnerability is fixed in 4.2.2.","datePublished":"May 27, 2026, 3:49:20 PM","dateUpdated":"May 28, 2026, 2:15:51 PM","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/free5gc/free5gc/security/advisories/GHSA-rxrq-fv76-26pr\nhttps://github.com/free5gc/free5gc/issues/924\nhttps://github.com/free5gc/nef/pull/25\nhttps://github.com/free5gc/nef/commit/f110517b1189801950b50668a593398687049074\n","aliases":"CVE-2026-44319\nGHSA-rxrq-fv76-26pr\n","assigner":"GitHub_M","epss":0.4,"enisaIdProduct":[{"id":"5c113d61-4906-33a3-9307-de8e17039c0a","product":{"name":"Free5GC","vendor":{"name":"Free5Gc"}},"product_version":"\u003c 4.2.2"}],"enisaIdVendor":[{"id":"a21144f7-ee32-3810-9695-21e7030a880f","vendor":{"name":"Free5Gc"}}],"enisaIdVulnerability":[{"id":"77fdc0a8-ebbb-33e9-95bb-52569c1197b6","vulnerability":{"id":"GHSA-rxrq-fv76-26pr","description":"free5GC\u0027s NEF crashes via logger.Fatal on PFD notification delivery failure (attacker-controlled notifyUri)","datePublished":"May 8, 2026, 10:44:35 PM","dateUpdated":"Jun 8, 2026, 11:47:12 PM","baseScore":0.0,"references":"https://github.com/free5gc/free5gc/security/advisories/GHSA-rxrq-fv76-26pr\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-44319\nhttps://github.com/free5gc/free5gc/issues/924\nhttps://github.com/free5gc/nef/pull/25\nhttps://github.com/free5gc/nef/commit/f110517b1189801950b50668a593398687049074\nhttps://github.com/free5gc/free5gc\n","enisa_id":"EUVD-2026-32579\n","aliases":"GHSA-rxrq-fv76-26pr\nCVE-2026-44319\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:00:21 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"be6cd014-d2f9-3c4f-b2d8-7943c5b48d2e","vulnerability":{"id":"CVE-2026-44319","description":"free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC\u0027s NEF terminates the entire process when a stored PFD-subscription notifyUri cannot be reached. In PfdChangeNotifier.FlushNotifications(), the notifier calls NnefPFDmanagementNotify(...) and on any delivery error invokes logger.PFDManageLog.Fatal(err), which is os.Exit(1)-equivalent in Go. An attacker who can create a PFD subscription with an attacker-chosen notifyUri and then trigger a PFD change can deterministically kill NEF on the asynchronous delivery attempt -- the process exits with status 1, dropping NEF\u0027s entire SBI surface until restart. This vulnerability is fixed in 4.2.2.","datePublished":"May 27, 2026, 3:49:20 PM","dateUpdated":"May 28, 2026, 2:15:51 PM","status":"PUBLISHED","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/free5gc/free5gc/security/advisories/GHSA-rxrq-fv76-26pr\nhttps://github.com/free5gc/free5gc/issues/924\nhttps://github.com/free5gc/nef/pull/25\nhttps://github.com/free5gc/nef/commit/f110517b1189801950b50668a593398687049074\n","enisa_id":"EUVD-2026-32579\n","assigner":"GitHub_M","epss":0.4,"dataProcessed":"Nov 7, 2026, 7:21:46 AM","vulnerabilityProduct":[{"id":"0617d742-e5ad-3074-b1c0-646258b0f9f2","product":{"name":"Free5GC","vendor":{"name":"Free5Gc"}},"product_version":"\u003c 4.2.2"}],"vulnerabilityVendor":[{"id":"a17346a1-b023-309b-9528-3329f9a039ae","vendor":{"name":"Free5Gc"}}]}}],"enisaIdAdvisory":[]}