free5GC AUSF: null byte injection in supiOrSuci causes HTTP 500 internal service failure
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · Low
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.
Summary
free5GC is an open-source implementation of the 5G core network. Prior to 1.4.5, the free5GC AUSF (Authentication Server Function) does not validate the supiOrSuci field in UE authentication requests. Null bytes (\x00) and other control characters pass through JSON parsing unchanged and are forwarded to the UDM in an unescaped URL path. This causes Go's net/url.Parse() to fail, returning HTTP 500 "System failure" and leaking internal stack traces. An unauthenticated attacker can trigger this at scale causing denial of service for all subscribers attempting authentication through the affected AUSF. This vulnerability is fixed in 1.4.5.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| free5gc | free5gc | before 4.2.2 | 4.2.2 | Patch available | CNA |
| free5gc | ausf | before 1.4.5 | 1.4.5 | Patch available | CNA |
| — | github.com/free5gc/free5gc (Go) | before 4.2.2 | 4.2.2 | Patch available | GHSA-qj55-47fp-p62j |
| — | github.com/free5gc/ausf (Go) | before 1.4.5 | 1.4.5 | Patch available | GHSA-qj55-47fp-p62j |
- free5gc Vendorfree5gc Affected before 4.2.2 Fixed in 4.2.2 Patch available CNA
- ausf Vendorfree5gc Affected before 1.4.5 Fixed in 1.4.5 Patch available CNA
- github.com/free5gc/free5gc (Go) Vendor— Affected before 4.2.2 Fixed in 4.2.2 Patch available GHSA-qj55-47fp-p62j
- github.com/free5gc/ausf (Go) Vendor— Affected before 1.4.5 Fixed in 1.4.5 Patch available GHSA-qj55-47fp-p62j
Remediation
- Fix · CNA free5gc (free5gc) Fixed in 4.2.2
- Fix · CNA ausf (free5gc) Fixed in 1.4.5
- Fix · GHSA-qj55-47fp-p62j github.com/free5gc/free5gc (Go) Fixed in 4.2.2 Advisory →
- Fix · GHSA-qj55-47fp-p62j github.com/free5gc/ausf (Go) Fixed in 1.4.5 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-53551
- 2026-10-03 Alias added: GHSA-qj55-47fp-p62j
References
Other 7
- https://github.com/free5gc/free5gc/security/advisories/GHSA-qj55-47fp-p62j
- https://github.com/free5gc/free5gc/issues/1048
- https://github.com/free5gc/ausf/pull/61
- https://github.com/free5gc/ausf/commit/bfc4a10094dbacbd862baa4686829f3fcc06ce1e
- https://github.com/free5gc/ausf/releases/tag/v1.4.5
- https://github.com/free5gc/free5gc/releases/tag/v4.2.2
- https://github.com/free5gc/free5gc
More free5gc vulnerabilities
- TI-2026-32298 Incorrect authorization in free5gc CVSS 3.1CRITICAL 10.0
- TI-2026-32297 free5GC: SMF UPI management interface lacks auth middleware; unauthenticated topology read/write requests reach handlers CVSS 3.1CRITICAL 10.0
- TI-2026-32295 free5GC: NEF nnef-oam route group is unauthenticated; no-token requests reach the OAM handler CVSS 3.1CRITICAL 10.0
- TI-2025-39412 free5gc v4.1.0 and before is vulnerable to Buffer Overflow. CVSS 3.1CRITICAL 9.8
- TI-2026-32294 Missing authorization in free5gc CVSS 3.1CRITICAL 9.4
- TI-2026-32283 Missing authorization in free5gc CVSS 3.1CRITICAL 9.4
Sources
- CVE-2026-53551 · CVE Program
- CVE-2026-53551 · NVD
- FIRST EPSS
- GHSA-qj55-47fp-p62j · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences