{"id":"EUVD-2026-68016","enisaUuid":"98469ba9-9893-31dc-806f-144f3c035e22","description":"free5GC is an open-source implementation of the 5G core network. In version 1.4.4 and earlier, the AUSF component stores per-subscriber authentication state in a global sync.Map named AUSFContext.UePool in internal/context/context.go, keyed only by SUPI. Every request handled by internal/sbi/processor/ue_authentication.go creates an AusfUeContext, and AddAusfUeContextToPool executes ausfContext.UePool.Store(ausfUeContext.Supi, ausfUeContext), unconditionally replacing the active context for that SUPI. An attacker with access to the AUSF SBI/N12 interface can send concurrent POST /nausf-auth/v1/ue-authentications requests for the same target SUPI, causing all attempts to share one logical authentication context URL while K_aut, XRES, and EapID are repeatedly overwritten. A valid EAP-AKA\u0027 response for an earlier challenge is then checked against the latest context, causing AT_MAC verification to fail and denying authentication to the selected subscriber while the request flood continues. No fixed version is available as of this review.","datePublished":"Aug 28, 2026, 10:23:41 PM","dateUpdated":"Sep 1, 2026, 2:04:02 AM","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/free5gc/free5gc/security/advisories/GHSA-334q-h5g3-fpxv\n","aliases":"CVE-2026-55784\nGHSA-334q-h5g3-fpxv\n","assigner":"GitHub_M","epss":0.42,"enisaIdProduct":[{"id":"1a9974eb-53c1-38cd-adf4-1c73d39c3f77","product":{"name":"Free5GC","vendor":{"name":"Free5Gc"}},"product_version":"≤ 1.4.4"}],"enisaIdVendor":[{"id":"73c37fe6-9110-3aa1-b229-ad1ec4a3e1b7","vendor":{"name":"Free5Gc"}}],"enisaIdVulnerability":[{"id":"e11953ca-d096-392f-8e78-dec5704026ec","vulnerability":{"id":"GHSA-334q-h5g3-fpxv","description":"free5GC AUSF authentication contexts can be overwritten by concurrent requests for the same SUPI","datePublished":"Aug 28, 2026, 10:24:11 PM","dateUpdated":"Aug 28, 2026, 10:24:12 PM","baseScore":0.0,"references":"https://github.com/free5gc/free5gc/security/advisories/GHSA-334q-h5g3-fpxv\nhttps://github.com/free5gc/free5gc\n","enisa_id":"EUVD-2026-68016\n","aliases":"CVE-2026-55784\nGHSA-334q-h5g3-fpxv\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:05:08 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"efe67125-0c7c-3448-8d16-fb73a1f0d267","vulnerability":{"id":"CVE-2026-55784","description":"free5GC is an open-source implementation of the 5G core network. In version 1.4.4 and earlier, the AUSF component stores per-subscriber authentication state in a global sync.Map named AUSFContext.UePool in internal/context/context.go, keyed only by SUPI. Every request handled by internal/sbi/processor/ue_authentication.go creates an AusfUeContext, and AddAusfUeContextToPool executes ausfContext.UePool.Store(ausfUeContext.Supi, ausfUeContext), unconditionally replacing the active context for that SUPI. An attacker with access to the AUSF SBI/N12 interface can send concurrent POST /nausf-auth/v1/ue-authentications requests for the same target SUPI, causing all attempts to share one logical authentication context URL while K_aut, XRES, and EapID are repeatedly overwritten. A valid EAP-AKA\u0027 response for an earlier challenge is then checked against the latest context, causing AT_MAC verification to fail and denying authentication to the selected subscriber while the request flood continues. No fixed version is available as of this review.","datePublished":"Aug 28, 2026, 10:23:41 PM","dateUpdated":"Sep 1, 2026, 2:04:02 AM","status":"PUBLISHED","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/free5gc/free5gc/security/advisories/GHSA-334q-h5g3-fpxv\n","enisa_id":"EUVD-2026-68016\n","assigner":"GitHub_M","epss":0.42,"dataProcessed":"Nov 3, 2026, 7:16:25 AM","vulnerabilityProduct":[{"id":"8a8e8e7f-76ad-3313-baed-a7ce95c51645","product":{"name":"Free5GC","vendor":{"name":"Free5Gc"}},"product_version":"≤ 1.4.4"}],"vulnerabilityVendor":[{"id":"f126bed2-65db-38c6-bb33-49ff3036b864","vendor":{"name":"Free5Gc"}}]}}],"enisaIdAdvisory":[]}