CVE-2026-44317 free5GC's PCF npcf-policyauthorization POST /app-sessions panics on suppFeat=1 with missing AfRoutReq via nil pointer dereference
An authenticated attacker can crash the free5GC PCF service by sending a specific policy authorization request, causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-44317?
CVE-2026-44317 is a medium-severity vulnerability in Free5gc Free5gc, published on 27 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's PCF POST /npcf-policyauthorization/v1/app-sessions handler panics on a single authenticated request whose ascReqData.suppFeat == "1" (enabling traffic-routing feature negotiation) and whose medComponents entries supply an afAppId but NO AfRoutReq. The create path then calls provisioningOfTrafficRoutingInfo(smPolicy, appID, routeReq, ...) with routeReq == nil and dereferences routeReq.RouteToLocs (and other fields) without a nil check, causing runtime error: invalid memory address or nil pointer dereference. Gin recovery converts the panic into HTTP 500. This vulnerability is fixed in 4.2.2.
Which versions are affected by CVE-2026-44317?
3 open source packages ship an affected version, including github.com/free5gc/pcf. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/free5gc/pcf Go | All versions | 1.4.3 |
github.com/free5gc/pcf Go | All versions | 1.4.3 |
github.com/free5gc/pcf Go | All versions | 1.4.3 |
Products include Free5gc Free5gc.
How do I fix CVE-2026-44317?
Upgrade github.com/free5gc/pcf to 1.4.3 or later.
Is CVE-2026-44317 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-44317 exists.
Other vulnerabilities in Free5gc Free5gc
- CVE-2026-44327 free5GC: NEF nnef-oam route group is unauthenticated; no-token requests reach the OAM handler
- CVE-2026-44329 free5GC's SMF UPI management interface lacks auth middleware; unauthenticated topology read/write requests reach handlers
- CVE-2026-44330 free5GC's NEF nnef-pfdmanagement API is unauthenticated; forged bearer tokens can read PFD data and create/delete PFD subscriptions
- CVE-2025-63679 Memory corruption in n/a
- CVE-2026-44315 free5GC's NEF 3gpp-pfd-management API is unauthenticated; forged bearer tokens can create, read, and delete PFD transactions
Sources
Also known as GHSA-wwqh-7jm5-gj7w, GO-2026-5731.