CVE-2026-1682 Free5GC SMF PFCP UDP Endpoint handler.go HandlePfcpAssociationReleaseRequest null pointer dereference

What is CVE-2026-1682?

CVE-2026-1682 is a medium-severity vulnerability in Free5gc Free5gc, published on 30 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A flaw has been found in Free5GC SMF up to 4.1.0. Affected is the function HandlePfcpAssociationReleaseRequest of the file internal/pfcp/handler/handler.go of the component PFCP UDP Endpoint. Executing a manipulation can lead to null pointer dereference. The attack may be launched remotely. The exploit has been published and may be used. A patch should be applied to remediate this issue.

Weakness: CWE-476, CWE-404

Which versions are affected by CVE-2026-1682?

It affects 1 product.

Products include Free5gc Free5gc.

How do I fix CVE-2026-1682?

No fix has been published for CVE-2026-1682 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-1682 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-1682 exists.

Other vulnerabilities in Free5gc Free5gc

• CVE-2026-44327 free5GC: NEF nnef-oam route group is unauthenticated; no-token requests reach the OAM handler Critical 10.0
• CVE-2026-44329 free5GC's SMF UPI management interface lacks auth middleware; unauthenticated topology read/write requests reach handlers Critical 10.0
• CVE-2026-44330 free5GC's NEF nnef-pfdmanagement API is unauthenticated; forged bearer tokens can read PFD data and create/delete PFD subscriptions Critical 10.0
• CVE-2025-63679 Memory corruption in n/a Critical 9.8
• CVE-2026-44315 free5GC's NEF 3gpp-pfd-management API is unauthenticated; forged bearer tokens can create, read, and delete PFD transactions Critical 9.4

All Free5gc Free5gc vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-hc69-r6rr-hmxf.