CVE-2026-44324 free5GC's UDR nudr-dr DELETE amf-subscriptions panics on missing UE state via nil interface type assertion (single authenticated request)
An authenticated attacker can cause a denial of service in free5GC UDR by triggering a panic via a nil interface type assertion on missing UE state.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-44324?
CVE-2026-44324 is a medium-severity vulnerability in Free5gc Free5gc, published on 27 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's UDR nudr-dr DELETE /subscription-data/{ueId}/{servingPlmnId}/ee-subscriptions/{subsId}/amf-subscriptions handler panics on a single authenticated request against a fresh UDR instance when the supplied ueId does not exist in UESubsCollection. The processor checks value, ok := udrSelf.UESubsCollection.Load(ueId) and sets a 404 USER_NOT_FOUND problem-details on the miss path, but execution continues and immediately runs value.(*udr_context.UESubsData) -- a Go type assertion on a nil interface, which panics with interface conversion: interface {} is nil, not *context.UESubsData. Gin recovery converts the panic into HTTP 500, but the endpoint remains repeatedly panicable. This vulnerability is fixed in 4.2.2.
Which versions are affected by CVE-2026-44324?
3 open source packages ship an affected version, including github.com/free5gc/udr. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/free5gc/udr Go | All versions | 1.4.3 |
github.com/free5gc/udr Go | All versions | 1.4.3 |
github.com/free5gc/udr Go | All versions | 1.4.3 |
Products include Free5gc Free5gc.
How do I fix CVE-2026-44324?
Upgrade github.com/free5gc/udr to 1.4.3 or later.
Is CVE-2026-44324 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-44324 exists.
Other vulnerabilities in Free5gc Free5gc
- CVE-2026-44327 free5GC: NEF nnef-oam route group is unauthenticated; no-token requests reach the OAM handler
- CVE-2026-44329 free5GC's SMF UPI management interface lacks auth middleware; unauthenticated topology read/write requests reach handlers
- CVE-2026-44330 free5GC's NEF nnef-pfdmanagement API is unauthenticated; forged bearer tokens can read PFD data and create/delete PFD subscriptions
- CVE-2025-63679 Memory corruption in n/a
- CVE-2026-44315 free5GC's NEF 3gpp-pfd-management API is unauthenticated; forged bearer tokens can create, read, and delete PFD transactions
Sources
Also known as GHSA-jqfc-gwj5-3w63, GO-2026-5478.