CVE-2026-44318 free5GC's BSF concurrent PUT /nbsf-management/v1/subscriptions/{subId} crashes the BSF process via concurrent map read/write on Subscriptions
Concurrent requests to the BSF subscription handler cause a race condition that crashes the process, resulting in denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-44318?
CVE-2026-44318 is a medium-severity vulnerability in Free5gc Free5gc, published on 27 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's BSF PUT /nbsf-management/v1/subscriptions/{subId} handler has an unsynchronized write on the global Subscriptions map. The handler first reads the map under RLock() via BSFContext.GetSubscription(subId), but if the subscription does not exist, ReplaceIndividualSubcription() writes back to the same map directly without taking the mutex (bsfContext.BsfSelf.Subscriptions[subId] = subscription). Under concurrent authenticated PUT load, one goroutine can read while another writes the map, which causes the Go runtime to abort the process with fatal error: concurrent map read and map write (Go runtime panics that come from concurrent map access bypass recover() and terminate the process). The BSF container exits with code 2 -- the entire BSF SBI surface goes down until restart. This vulnerability is fixed in 4.2.2.
Which versions are affected by CVE-2026-44318?
3 open source packages ship an affected version, including github.com/free5gc/bsf. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/free5gc/bsf Go | All versions | 1.0.2 |
github.com/free5gc/bsf Go | All versions | 1.0.2 |
github.com/free5gc/bsf Go | All versions | 1.0.2 |
Products include Free5gc Free5gc.
How do I fix CVE-2026-44318?
Upgrade github.com/free5gc/bsf to 1.0.2 or later.
Is CVE-2026-44318 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-44318 exists.
Other vulnerabilities in Free5gc Free5gc
- CVE-2026-44327 free5GC: NEF nnef-oam route group is unauthenticated; no-token requests reach the OAM handler
- CVE-2026-44329 free5GC's SMF UPI management interface lacks auth middleware; unauthenticated topology read/write requests reach handlers
- CVE-2026-44330 free5GC's NEF nnef-pfdmanagement API is unauthenticated; forged bearer tokens can read PFD data and create/delete PFD subscriptions
- CVE-2025-63679 Memory corruption in n/a
- CVE-2026-44315 free5GC's NEF 3gpp-pfd-management API is unauthenticated; forged bearer tokens can create, read, and delete PFD transactions
Sources
Also known as GHSA-27ph-8q4f-h7m7, GO-2026-4994.