https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 11:26:37 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-322207 EUVD-2026-322207 https://cve.radiocsirt.org/vuln/euvd-2026-322207 https://cve.radiocsirt.org/vuln/fkie_cve-2026-44328 <p>free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC&#39;s SMF mounts the UPI management route group without inbound OAuth2 middleware. On top of that, the DELETE /upi/v1/upNodesLinks/{upNodeRef} handler unconditionally dereferences upNode.UPF after the type-guarded async release, even though AN-typed nodes are constructed without a UPF object. As a result, a single unauthenticated DELETE /upi/v1/upNodesLinks/gNB1 request crashes the handler with a nil-pointer panic AND mutates the in-memory user-plane topology before panicking (the UpNodeDelete(upNodeRef) line runs first). This is an unauthenticated, state-mutating panic-DoS sink that an off-path network attacker can trigger by name against any AN entry. This vulnerability is fixed in 4.2.2.</p> <p>free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC&#39;s SMF mounts the UPI management route group without inbound OAuth2 middleware. On top of that, the DELETE /upi/v1/upNodesLinks/{upNodeRef} handler unconditionally dereferences upNode.UPF after the type-guarded async release, even though AN-typed nodes are constructed without a UPF object. As a result, a single unauthenticated DELETE /upi/v1/upNodesLinks/gNB1 request crashes the handler with a nil-pointer panic AND mutates the in-memory user-plane topology before panicking (the UpNodeDelete(upNodeRef) line runs first). This is an unauthenticated, state-mutating panic-DoS sink that an off-path network attacker can trigger by name against any AN entry. This vulnerability is fixed in 4.2.2.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-44328 https://cve.radiocsirt.org/vuln/ghsa-p9mg-74mg-cwwr <p><strong>Affected:</strong> Go: github.com/free5gc/smf</p> <p>### Summary free5GC&#39;s SMF mounts the `UPI` management route group without inbound OAuth2 middleware (same root cause as the broader UPI auth gap reported in free5gc/free5gc#887). On top of that, the `DELETE /upi/v1/upNodesLinks/{upNodeRef}` handler unconditionally dereferences `upNode.UPF` after the type-guarded async release, even though `AN`-typed nodes are constructed without a `UPF` object. As a result, a single unauthenticated `DELETE /upi/v1/upNodesLinks/gNB1` request crashes the handler with a nil-pointer panic AND mutates the in-memory user-plane topology before panicking (the `UpNodeDelete(upNodeRef)` line runs first). This is an unauthenticated, state-mutating panic-DoS sink that an off-path network attacker can trigger by name against any AN entry.</p> <p>### Details Validated against the SMF container in the official Docker compose lab. - Source repo tag: `v4.2.1` - Running Docker image: `free5gc/smf:v4.2.1` - Runtime SMF commit: `8385c00a` - Docker validation date: 2026-03-22 local (container log timestamp `2026-03-21T23:43:17Z`) - SMF endpoint: `http://10.100.200.6:8000`</p> <p>Control comparison on the same SMF instance: - `GET /nsmf-oam/v1/` (no token) -&gt; `401 Unauthorized` - `DELETE /upi/v1/upNodesLinks/gNB1` (no token) -&gt; `500 Internal Server Error` (panic)</p> <p>The sibling `nsmf-oam` returning `401` proves OAuth middleware IS wired in for other SMF route groups; the UPI group specifically is mounted without it.</p> <p>Vulnerable handler logic (paths in `free5gc/smf`): ```go //…</p> <p><strong>Affected:</strong> Go: github.com/free5gc/smf</p> <p>### Summary free5GC&#39;s SMF mounts the `UPI` management route group without inbound OAuth2 middleware (same root cause as the broader UPI auth gap reported in free5gc/free5gc#887). On top of that, the `DELETE /upi/v1/upNodesLinks/{upNodeRef}` handler unconditionally dereferences `upNode.UPF` after the type-guarded async release, even though `AN`-typed nodes are constructed without a `UPF` object. As a result, a single unauthenticated `DELETE /upi/v1/upNodesLinks/gNB1` request crashes the handler with a nil-pointer panic AND mutates the in-memory user-plane topology before panicking (the `UpNodeDelete(upNodeRef)` line runs first). This is an unauthenticated, state-mutating panic-DoS sink that an off-path network attacker can trigger by name against any AN entry.</p> <p>### Details Validated against the SMF container in the official Docker compose lab. - Source repo tag: `v4.2.1` - Running Docker image: `free5gc/smf:v4.2.1` - Runtime SMF commit: `8385c00a` - Docker validation date: 2026-03-22 local (container log timestamp `2026-03-21T23:43:17Z`) - SMF endpoint: `http://10.100.200.6:8000`</p> <p>Control comparison on the same SMF instance: - `GET /nsmf-oam/v1/` (no token) -&gt; `401 Unauthorized` - `DELETE /upi/v1/upNodesLinks/gNB1` (no token) -&gt; `500 Internal Server Error` (panic)</p> <p>The sibling `nsmf-oam` returning `401` proves OAuth middleware IS wired in for other SMF route groups; the UPI group specifically is mounted without it.</p> <p>Vulnerable handler logic (paths in `free5gc/smf`): ```go //…</p> https://cve.radiocsirt.org/vuln/ghsa-p9mg-74mg-cwwr