CVE-2026-44324
free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's UDR nudr-dr DELETE /subscription-data/{ueId}/{servingPlmnId}/ee-subscriptions/{subsId}/amf-subscriptions handler panics on a single authenticated request against a fresh UDR instance when the supplied ueId does not exist in UESubsCollection. The processor checks value, ok := udrSelf.UESubsCollection.Load(ueId) and sets a 404 USER_NOT_FOUND problem-details on the miss path, but execution continues and immediately runs value.(*udr_context.UESubsData) -- a Go type assertion on a nil interface, which panics with interface conversion: interface {} is nil, not *context.UESubsData. Gin recovery converts the panic into HTTP 500, but the endpoint remains repeatedly panicable. This vulnerability is fixed in 4.2.2.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 6.5
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- EPSS probability
- 0.42%
- CWE
- CWE-704, CWE-754
- Published
- 2026-05-27
- Last modified
- 2026-05-28
Affected products
- free5gc free5gc
Weakness type
Related vulnerabilities
- CVE-2026-87546 — Incorrect type conversion or cast in Safebrowsing in Google Chrome on on Mac prior to 153.0.8010.36...
- CVE-2026-69585 — Microsoft Windows Search Component Elevation of Privilege Vulnerability
- CVE-2026-50278 — iccDEV: CIccEmbedIO::Read8() size_t underflow
- CVE-2026-10080 — Boards plugin panics on WebSocket command with non-string field types
- CVE-2026-15826 — User Profile Builder <= 3.16.4 - Unauthenticated Authentication Bypass via Type Confusion to Administrator Account Takeover via 'username' Parameter
- CVE-2026-53798 — rsync < 3.5.0 Privilege Confusion via name-converter uid/gid mapping
- CVE-2026-73429 — Russh: client wrong-length X25519 `clone_from_slice` panic (pre-auth DoS)
- CVE-2026-18675 — Kong Mesh: control plane denial of service via a malformed dataplane token with a non-string JWT kid