CVE-2026-44323 free5GC: UDR nudr-dr DELETE amf-subscriptions panics on missing subsId when UE state exists (nil pointer dereference)
An authenticated attacker can cause a denial of service in free5GC UDR by triggering a nil pointer dereference via a specific DELETE request.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-44323?
CVE-2026-44323 is a medium-severity vulnerability in Free5gc Free5gc, published on 27 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's UDR nudr-dr DELETE /subscription-data/{ueId}/{servingPlmnId}/ee-subscriptions/{subsId}/amf-subscriptions handler contains a nil-pointer dereference reachable from a single authenticated request, after one preparatory authenticated EE-subscription create. The handler checks _, ok = UESubsData.EeSubscriptionCollection[subsId] and sets a 404 problem-details on the miss path, but then continues to UESubsData.EeSubscriptionCollection[subsId].AmfSubscriptionInfos -- dereferencing the same missing entry instead of returning. Gin recovery converts the panic into HTTP 500, but the endpoint remains repeatedly panicable. This vulnerability is fixed in 4.2.2.
Weakness: CWE-476
Which versions are affected by CVE-2026-44323?
3 open source packages ship an affected version, including github.com/free5gc/udr. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/free5gc/udr Go | All versions | 1.4.3 |
github.com/free5gc/udr Go | All versions | 1.4.3 |
github.com/free5gc/udr Go | All versions | 1.4.3 |
Products include Free5gc Free5gc.
How do I fix CVE-2026-44323?
Upgrade github.com/free5gc/udr to 1.4.3 or later.
Is CVE-2026-44323 being exploited?
There is no known exploitation of CVE-2026-44323 in the wild and no public exploit code.
Other vulnerabilities in Free5gc Free5gc
- CVE-2026-44327 free5GC: NEF nnef-oam route group is unauthenticated; no-token requests reach the OAM handler
- CVE-2026-44329 free5GC's SMF UPI management interface lacks auth middleware; unauthenticated topology read/write requests reach handlers
- CVE-2026-44330 free5GC's NEF nnef-pfdmanagement API is unauthenticated; forged bearer tokens can read PFD data and create/delete PFD subscriptions
- CVE-2025-63679 Memory corruption in n/a
- CVE-2026-44315 free5GC's NEF 3gpp-pfd-management API is unauthenticated; forged bearer tokens can create, read, and delete PFD transactions
Sources
Also known as GHSA-4rqf-grm6-vf75, GO-2026-5131.