Description

An issue in the ModifyAMFEventSubscriptionProcedure function (processor/event_exposure.go) of free5gc v4.1.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted PATCH request.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-27T17:17:50.537Z",
  "pubdate": "2026-08-27T17:17:50.537Z",
  "executiveSummary": "A Denial of Service (DoS) vulnerability exists in the free5gc v4.1.0 AMF (Access and Mobility Management Function) module, specifically within the event exposure procedure.\nThe issue is triggered by an improperly handled PATCH request directed at the ModifyAMFEventSubscriptionProcedure function.\nBy submitting a maliciously crafted request, an attacker can induce a process crash or service disruption, effectively neutralizing the affected AMF component.\nThis vulnerability poses a significant risk to the availability of the 5G core network, as the AMF is a critical control plane node responsible for signaling, registration, and mobility management.\nThe attack requires network-level access to the Nnef/Namf interface and does not explicitly require privileged credentials, depending on the network security posture.\nSuccessful exploitation results in immediate service instability, preventing legitimate user equipment (UE) from accessing network services, thereby impacting overall 5G service continuity.",
  "technicalDetails": "The vulnerability is located within the ModifyAMFEventSubscriptionProcedure function, situated in processor/event_exposure.go. This function is responsible for processing PATCH requests sent to the AMF event exposure service, which allows external network functions or entities to subscribe to or modify mobility-related events.\nThe root cause of the vulnerability stems from inadequate input validation and improper error handling of the JSON payload during the PATCH operation. When the ModifyAMFEventSubscriptionProcedure function parses the incoming request body, it fails to safely validate the structure or contents of the provided parameters before proceeding with the internal modification logic. If the crafted PATCH request contains malformed data, unexpected field types, or logic inconsistencies that the state machine does not anticipate, the application encounters an unhandled exception or a panic condition during state transition.\nThe attack flow follows a structured path: An attacker initiates a HTTP PATCH request targeting the AMF event exposure endpoint, specifically aiming at the existing subscription resource. The payload is crafted to include data structures that violate the internal state expectations of the ModifyAMFEventSubscriptionProcedure. As the function attempts to iterate over or map these fields to the internal subscription object in memory, the lack of bound checking or schema verification results in an illegal memory access or a runtime panic.\nBecause the free5gc core components are typically written in Go, such unhandled panics lead to the termination of the associated goroutine or the entire service process. Given the architecture of the AMF, a crash in the event exposure handler can lead to a cascading failure of the subscription management logic, resulting in a Denial of Service. The vulnerability is exploitable via the Nnef service-based interface. Authentication requirements depend on the existing security policy enforcement between network functions, but if the interface is exposed or if the attacker has gained a foothold within the signaling network, no further authentication is required to send the malicious PATCH request. Post-exploitation, the AMF service remains in a failed state until manual intervention or a service restart occurs, causing prolonged outages for subscribers registered to the affected node."
}