Read the docs
TI-2026-03936 Aliases CVE-2026-4531GHSA-xq44-64rg-8g3h

Free5GC AMF handler.go HandleRegistrationComplete denial of service

Priority HIGH 70CWE-404Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-404.

Summary

A weakness has been identified in Free5GC 4.1.0. Affected is the function HandleRegistrationComplete of the file internal/gmm/handler.go of the component AMF. Executing a manipulation can lead to denial of service. The attack may be performed from remote. This patch is called 52e9386401ce56ea773c5aa587d4cdf7d53da799. It is best practice to apply a patch to resolve this issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00435 37th percentileScored 2026-11-07
Fix Fixed github.com/free5gc/amf (Go): 1.4.3-0.20260306074636-52e9386401ce

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Free5GC4.1.0—No fix listedCNA
—github.com/free5gc/amf (Go)before 1.4.3-0.20260306074636-52e9386401ce1.4.3-0.20260306074636-52e9386401cePatch availableGHSA-xq44-64rg-8g3h
  • Free5GC Vendor— Affected 4.1.0 Fixed in — No fix listed CNA
  • github.com/free5gc/amf (Go) Vendor— Affected before 1.4.3-0.20260306074636-52e9386401ce Fixed in 1.4.3-0.20260306074636-52e9386401ce Patch available GHSA-xq44-64rg-8g3h

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:free5gc:free5gc:*:*:*:*:*:*:*:*——free5gc
  • cpe:2.3:a:free5gc:free5gc:*:*:*:*:*:*:*:* Versions — — ·free5gc

Remediation

  • Fix · GHSA-xq44-64rg-8g3h github.com/free5gc/amf (Go) Fixed in 1.4.3-0.20260306074636-52e9386401ce Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-4531
  2. 2026-10-03 Alias added: GHSA-xq44-64rg-8g3h
  3. 2026-10-25 EPSS moved to the below the 50th percentile

References

Patch 2

Advisory 1

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences