cnvd-2026-37845

EUVD-2026-343759

fkie_cve-2026-53551

free5GC is an open-source implementation of the 5G core network. Prior to 1.4.5, the free5GC AUSF (Authentication Server Function) does not validate the supiOrSuci field in UE authentication requests. Null bytes (\x00) and other control characters pass through JSON parsing unchanged and are forwarded to the UDM in an unescaped URL path. This causes Go's net/url.Parse() to fail, returning HTTP 500 "System failure" and leaking internal stack traces. An unauthenticated attacker can trigger this at scale causing denial of service for all subscribers attempting authentication through the affected AUSF. This vulnerability is fixed in 1.4.5.

GHSA-qj55-47fp-p62j — free5GC AUSF: null byte injection in supiOrSuci causes HTTP 500 internal service failure

Affected: Go: github.com/free5gc/free5gc, Go: github.com/free5gc/ausf

### Summary

The free5GC AUSF (Authentication Server Function) does not validate the `supiOrSuci` field in UE authentication requests. Null bytes (`\x00`) and other control characters pass through JSON parsing unchanged and are forwarded to the UDM in an unescaped URL path. This causes Go's `net/url.Parse()` to fail, returning HTTP 500 "System failure" and leaking internal stack traces. An unauthenticated attacker can trigger this at scale—4.1% of `special_chars` mutations produce HTTP 500—causing denial of service for all subscribers attempting authentication through the affected AUSF. CWE-20 (Improper Input Validation).

---

### Details

The vulnerability lies in the AUSF's `POST /nausf-auth/v1/ue-authentications` handler. The JSON body includes a `supiOrSuci` field:

```json {"supiOrSuci": "imsi-208930000000031", "servingNetworkName": "...", "authType": "5G_AKA"} ```

The AUSF parses this JSON (Go's `encoding/json` accepts null bytes in strings per RFC 8259), then constructs a UDM URL by directly embedding the raw `supiOrSuci` value:

``` GET /nudm-ueau/v1/{supiOrSuci}/security-information/... ```

When `supiOrSuci` contains null bytes (`\x00`), the resulting URL is illegal under RFC 3986. Go's `net/url.Parse()` fails, and the error propagates as an unhandled internal error, returning HTTP 500 with a stack trace in the response body:

``` {"error":{"status":"INTERNAL_SERVER_ERROR","message":"System failure"}} ```

The AUSF container log shows: `net/url: invalid control c…

Most recent entries from all

cnvd-2026-37845

EUVD-2026-343759

fkie_cve-2026-53551

GHSA-qj55-47fp-p62j — free5GC AUSF: null byte injection in supiOrSuci causes HTTP 500 internal service failure