https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 10:12:49 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-322216 EUVD-2026-322216 https://cve.radiocsirt.org/vuln/euvd-2026-322216 https://cve.radiocsirt.org/vuln/fkie_cve-2026-44321 <p>free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC&#39;s SMF mounts the UPI management route group without inbound OAuth2 middleware. The POST /upi/v1/upNodesLinks create-or-update handler accepts attacker-controlled JSON and passes it directly into UpNodesFromConfiguration(), which calls logger.InitLog.Fatalf(...) on several validation failures. One confirmed path is the UE-IP-pool overlap check: a single unauthenticated POST that adds a new UPF whose pool overlaps an existing UPF terminates the entire SMF process (docker ps shows Exited (1)), not just the goroutine. This vulnerability is fixed in 4.2.2.</p> <p>free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC&#39;s SMF mounts the UPI management route group without inbound OAuth2 middleware. The POST /upi/v1/upNodesLinks create-or-update handler accepts attacker-controlled JSON and passes it directly into UpNodesFromConfiguration(), which calls logger.InitLog.Fatalf(...) on several validation failures. One confirmed path is the UE-IP-pool overlap check: a single unauthenticated POST that adds a new UPF whose pool overlaps an existing UPF terminates the entire SMF process (docker ps shows Exited (1)), not just the goroutine. This vulnerability is fixed in 4.2.2.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-44321 https://cve.radiocsirt.org/vuln/ghsa-44qj-cghf-9p97 <p><strong>Affected:</strong> Go: github.com/free5gc/smf</p> <p>### Summary free5GC&#39;s SMF mounts the `UPI` management route group without inbound OAuth2 middleware (same root cause as free5gc/free5gc#887). The `POST /upi/v1/upNodesLinks` create-or-update handler accepts attacker-controlled JSON and passes it directly into `UpNodesFromConfiguration()`, which calls `logger.InitLog.Fatalf(...)` on several validation failures. One confirmed path is the UE-IP-pool overlap check: a single unauthenticated POST that adds a new UPF whose pool overlaps an existing UPF terminates the entire SMF process (`docker ps` shows `Exited (1)`), not just the goroutine. This is a stronger sink than free5gc/free5gc#905: that one panics inside the request goroutine and Gin recovers; this one calls `Fatalf` which is `os.Exit(1)`-equivalent and kills the whole SMF process, dropping all of SMF&#39;s SBI surface (PDU-session establishment, UE policy lookups, etc.) until the process is restarted.</p> <p>### Details Validated against the SMF container in the official Docker compose lab. - Source repo tag: `v4.2.1` - Running Docker image: `free5gc/smf:v4.2.1` - Runtime SMF commit: `8385c00a` - Docker validation date: 2026-03-22 local (container log timestamp `2026-03-21T23:47:07Z`) - SMF endpoint: `http://10.100.200.6:8000`</p> <p>The broader `UPI` auth gap (#887) lets the unauthenticated POST reach the create/update handler. From there:</p> <p>Vulnerable handler dispatches into topology parsing: ``` POST /upi/v1/upNodesLinks -&gt; UpNodesFromConfiguration() -&gt; isOverlap(allUEIPPools)…</p> <p><strong>Affected:</strong> Go: github.com/free5gc/smf</p> <p>### Summary free5GC&#39;s SMF mounts the `UPI` management route group without inbound OAuth2 middleware (same root cause as free5gc/free5gc#887). The `POST /upi/v1/upNodesLinks` create-or-update handler accepts attacker-controlled JSON and passes it directly into `UpNodesFromConfiguration()`, which calls `logger.InitLog.Fatalf(...)` on several validation failures. One confirmed path is the UE-IP-pool overlap check: a single unauthenticated POST that adds a new UPF whose pool overlaps an existing UPF terminates the entire SMF process (`docker ps` shows `Exited (1)`), not just the goroutine. This is a stronger sink than free5gc/free5gc#905: that one panics inside the request goroutine and Gin recovers; this one calls `Fatalf` which is `os.Exit(1)`-equivalent and kills the whole SMF process, dropping all of SMF&#39;s SBI surface (PDU-session establishment, UE policy lookups, etc.) until the process is restarted.</p> <p>### Details Validated against the SMF container in the official Docker compose lab. - Source repo tag: `v4.2.1` - Running Docker image: `free5gc/smf:v4.2.1` - Runtime SMF commit: `8385c00a` - Docker validation date: 2026-03-22 local (container log timestamp `2026-03-21T23:47:07Z`) - SMF endpoint: `http://10.100.200.6:8000`</p> <p>The broader `UPI` auth gap (#887) lets the unauthenticated POST reach the create/update handler. From there:</p> <p>Vulnerable handler dispatches into topology parsing: ``` POST /upi/v1/upNodesLinks -&gt; UpNodesFromConfiguration() -&gt; isOverlap(allUEIPPools)…</p> https://cve.radiocsirt.org/vuln/ghsa-44qj-cghf-9p97