CVE-2026-44316: Free5gc NULL pointer dereference (CVSS 7.5)

Description

free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's PCF POST /npcf-smpolicycontrol/v1/sm-policies handler (HandleCreateSmPolicyRequest) panics with a nil-pointer dereference when a downstream OpenAPI consumer call (UDR lookup) returns 404 Not Found and the consumer wrapper returns err != nil together with a nil response struct. The handler logs the OpenAPI error and continues executing instead of returning, then dereferences the nil response struct on a subsequent line and panics. Gin recovery converts the panic into HTTP 500, so a single attacker-shaped POST returns 500 instead of a clean 4xx whenever the downstream lookup fails. The PCF process keeps running. The trigger is a single POST containing input that causes the downstream UDR lookup to fail (e.g. an unknown DNN). In 4.2.1 this endpoint is also reachable WITHOUT an Authorization header because the PCF Npcf_SMPolicyControl route group is mounted without inbound auth middleware. This vulnerability is fixed in 4.2.2.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeUnchanged

ConfidentialityNone

IntegrityNone

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Free5gc< 4.2.2

Remediation

Fixed in

Free5gc≥ 4.2.2

Patch & vendor advisories

References

https://github.com/free5gc/free5gc/issues/803ExploitIssue Tracking
https://github.com/free5gc/free5gc/security/advisories/GHSA-wr8j-6chw-gm6pExploitVendor Advisory
https://github.com/free5gc/pcf/commit/df535f5524314620715e842baf9723efbeb481a7Patch
https://github.com/free5gc/pcf/pull/62Issue TrackingPatch

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2026-44316 being actively exploited?

CVE-2026-44316 is not in the CISA KEV catalog. A public exploit reference exists, so treat it as exploitable. Its EPSS exploit probability is 0.66%.

How severe is CVE-2026-44316?

CVE-2026-44316 has a CVSS 3.1 base score of 7.5, rated high. EPSS estimates a 0.66% probability of exploitation.

Which products are affected by CVE-2026-44316?

Affected products include Free5gc.

How do I fix CVE-2026-44316?

Upgrade affected software to a fixed version, for example Free5gc 4.2.2 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-44316 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo