https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 17:51:11 +0000 https://cve.radiocsirt.org/vuln/cnvd-2026-37850 cnvd-2026-37850 https://cve.radiocsirt.org/vuln/cnvd-2026-37850 https://cve.radiocsirt.org/vuln/euvd-2026-322457 EUVD-2026-322457 https://cve.radiocsirt.org/vuln/euvd-2026-322457 https://cve.radiocsirt.org/vuln/fkie_cve-2026-44317 <p>free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC&#39;s PCF POST /npcf-policyauthorization/v1/app-sessions handler panics on a single authenticated request whose ascReqData.suppFeat == &#34;1&#34; (enabling traffic-routing feature negotiation) and whose medComponents entries supply an afAppId but NO AfRoutReq. The create path then calls provisioningOfTrafficRoutingInfo(smPolicy, appID, routeReq, ...) with routeReq == nil and dereferences routeReq.RouteToLocs (and other fields) without a nil check, causing runtime error: invalid memory address or nil pointer dereference. Gin recovery converts the panic into HTTP 500. This vulnerability is fixed in 4.2.2.</p> <p>free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC&#39;s PCF POST /npcf-policyauthorization/v1/app-sessions handler panics on a single authenticated request whose ascReqData.suppFeat == &#34;1&#34; (enabling traffic-routing feature negotiation) and whose medComponents entries supply an afAppId but NO AfRoutReq. The create path then calls provisioningOfTrafficRoutingInfo(smPolicy, appID, routeReq, ...) with routeReq == nil and dereferences routeReq.RouteToLocs (and other fields) without a nil check, causing runtime error: invalid memory address or nil pointer dereference. Gin recovery converts the panic into HTTP 500. This vulnerability is fixed in 4.2.2.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-44317 https://cve.radiocsirt.org/vuln/ghsa-wwqh-7jm5-gj7w <p><strong>Affected:</strong> Go: github.com/free5gc/pcf</p> <p>### Summary free5GC&#39;s PCF `POST /npcf-policyauthorization/v1/app-sessions` handler panics on a single authenticated request whose `ascReqData.suppFeat == &#34;1&#34;` (enabling traffic-routing feature negotiation) and whose `medComponents` entries supply an `afAppId` but NO `AfRoutReq`. The create path then calls `provisioningOfTrafficRoutingInfo(smPolicy, appID, routeReq, ...)` with `routeReq == nil` and dereferences `routeReq.RouteToLocs` (and other fields) without a nil check, causing `runtime error: invalid memory address or nil pointer dereference`. Gin recovery converts the panic into `HTTP 500`.</p> <p>The trigger is a single valid authenticated request -- changing only `suppFeat` from `&#34;0&#34;` to `&#34;1&#34;` flips the same shape of POST from a normal `201 Created` into a panic-driven `500`.</p> <p>This endpoint requires a valid `npcf-policyauthorization` OAuth2 access token (PR:L). The PCF process is not killed (Gin recovers); the realized impact is per-request panic-DoS on the app-session create path.</p> <p>### Details Validated against the PCF container in the official Docker compose lab. - Source repo tag: `v4.2.1` - PCF endpoint: `http://10.100.200.9:8000` - Validation date: 2026-03-12</p> <p>Vulnerable handler path: ``` postAppSessCtxProcedure -&gt; medComponents loop -&gt; appID := medComp.AfAppId routeReq := medComp.AfRoutReq // nil when AfRoutReq absent provisioningOfTrafficRoutingInfo(smPolicy, appID, routeReq, medComp.FStatus) ```</p> <p>In `provisioningOfTrafficRoutingInfo`, `routeReq.Rout…</p> <p><strong>Affected:</strong> Go: github.com/free5gc/pcf</p> <p>### Summary free5GC&#39;s PCF `POST /npcf-policyauthorization/v1/app-sessions` handler panics on a single authenticated request whose `ascReqData.suppFeat == &#34;1&#34;` (enabling traffic-routing feature negotiation) and whose `medComponents` entries supply an `afAppId` but NO `AfRoutReq`. The create path then calls `provisioningOfTrafficRoutingInfo(smPolicy, appID, routeReq, ...)` with `routeReq == nil` and dereferences `routeReq.RouteToLocs` (and other fields) without a nil check, causing `runtime error: invalid memory address or nil pointer dereference`. Gin recovery converts the panic into `HTTP 500`.</p> <p>The trigger is a single valid authenticated request -- changing only `suppFeat` from `&#34;0&#34;` to `&#34;1&#34;` flips the same shape of POST from a normal `201 Created` into a panic-driven `500`.</p> <p>This endpoint requires a valid `npcf-policyauthorization` OAuth2 access token (PR:L). The PCF process is not killed (Gin recovers); the realized impact is per-request panic-DoS on the app-session create path.</p> <p>### Details Validated against the PCF container in the official Docker compose lab. - Source repo tag: `v4.2.1` - PCF endpoint: `http://10.100.200.9:8000` - Validation date: 2026-03-12</p> <p>Vulnerable handler path: ``` postAppSessCtxProcedure -&gt; medComponents loop -&gt; appID := medComp.AfAppId routeReq := medComp.AfRoutReq // nil when AfRoutReq absent provisioningOfTrafficRoutingInfo(smPolicy, appID, routeReq, medComp.FStatus) ```</p> <p>In `provisioningOfTrafficRoutingInfo`, `routeReq.Rout…</p> https://cve.radiocsirt.org/vuln/ghsa-wwqh-7jm5-gj7w