Resource exhaustion in Free5GC PFCP session setup failure handling
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-400.
Summary
Free5GC v4.2.3 does not release allocated UE IP address resources when the SMF receives no PFCP Session Establishment Response from the UPF. Uncontrolled resource consumption (CWE-400) lets repeated failed session attempts exhaust the UE IP address pool. An unauthenticated remote attacker can cause denial of service, because new UEs cannot establish PDU sessions.
Written with Claude Haiku 5.5 from the sources below · 2026-11-05
Description from the CNA
A resource exhaustion issue exists in Free5GC v4.2.3 during PFCP Session Establishment failure handling. When the SMF does not receive a PFCP Session Establishment Response from the UPF, allocated UE IP address resources are not properly released. Repeated failed session establishment attempts can therefore exhaust the UE IP address pool, preventing new UEs from establishing PDU sessions and resulting in denial of service.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
Remediation
The sources list no fixed version for Free5GC.
Written with Claude Haiku 5.5 from the sources below · 2026-11-05
Timeline
- 2026-11-02 Threatist record created from CVE-2026-106805
- 2026-11-02 Alias added: GHSA-j2m9-hp34-9gm7
- 2026-11-05 CVSS score added · CISA ADP
- 2026-11-05 Weakness changed · CISA ADP
- 2026-11-05 CISA SSVC decision points changed
- 2026-11-05 Priority changed: LOW → HIGH
References
Sources
- CVE-2026-106805 · CVE Program
- CVE-2026-106805 · NVD
- FIRST EPSS
- GHSA-j2m9-hp34-9gm7 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences