TI-2026-32287 Aliases CVE-2026-44319 GHSA-rxrq-fv76-26pr

free5GC: NEF crashes via logger.Fatal on PFD notification delivery failure (attacker-controlled notifyUri)

HIGH 72CWE-20Published 2026-05-27 · Updated 2026-05-28

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-617.

Summary

free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's NEF terminates the entire process when a stored PFD-subscription notifyUri cannot be reached. In PfdChangeNotifier.FlushNotifications(), the notifier calls NnefPFDmanagementNotify(...) and on any delivery error invokes logger.PFDManageLog.Fatal(err), which is os.Exit(1)-equivalent in Go. An attacker who can create a PFD subscription with an attacker-chosen notifyUri and then trigger a PFD change can deterministically kill NEF on the asynchronous delivery attempt -- the process exits with status 1, dropping NEF's entire SBI surface until restart. This vulnerability is fixed in 4.2.2.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00404 34th percentileScored 2026-11-07

Public exploit Yes 2 exploit referencesTagged by NVD

Fix Fixed free5gc (free5gc): 4.2.2github.com/free5gc/nef (Go): 1.2.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
free5gc	free5gc	before 4.2.2	4.2.2	Patch available	CNA
—	github.com/free5gc/nef (Go)	before 1.2.3	1.2.3	Patch available	GHSA-rxrq-fv76-26pr

free5gc Vendorfree5gc Affected before 4.2.2 Fixed in 4.2.2 Patch available CNA
github.com/free5gc/nef (Go) Vendor— Affected before 1.2.3 Fixed in 1.2.3 Patch available GHSA-rxrq-fv76-26pr

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:free5gc:free5gc::::::::	before 4.2.2	Vulnerable	free5gc

cpe:2.3:a:free5gc:free5gc:*:*:*:*:*:*:*:* Versions before 4.2.2 Vulnerable ·free5gc

Remediation

Fix · CNA free5gc (free5gc) Fixed in 4.2.2
Fix · GHSA-rxrq-fv76-26pr github.com/free5gc/nef (Go) Fixed in 1.2.3 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-44319
2026-10-03 Alias added: GHSA-rxrq-fv76-26pr
2026-10-13 EPSS moved to the 50th–90th percentile
2026-10-25 EPSS moved to the below the 50th percentile

References

Exploit 2

Patch 2

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-44319

Other 1

https://github.com/free5gc/free5gc

TI-2026-32298 Incorrect authorization in free5gc CVSS 3.1CRITICAL 10.0
TI-2026-32297 free5GC: SMF UPI management interface lacks auth middleware; unauthenticated topology read/write requests reach handlers CVSS 3.1CRITICAL 10.0
TI-2026-32295 free5GC: NEF nnef-oam route group is unauthenticated; no-token requests reach the OAM handler CVSS 3.1CRITICAL 10.0
TI-2025-39412 free5gc v4.1.0 and before is vulnerable to Buffer Overflow. CVSS 3.1CRITICAL 9.8
TI-2026-32294 Missing authorization in free5gc CVSS 3.1CRITICAL 9.4
TI-2026-32283 Missing authorization in free5gc CVSS 3.1CRITICAL 9.4

See all 58 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences