Description

An issue in the CreateUEContext handler component of free5gc v4.1.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted request.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-27T17:17:50.897Z",
  "pubdate": "2026-08-27T17:17:50.897Z",
  "executiveSummary": "A Denial of Service (DoS) vulnerability exists within the CreateUEContext handler component of free5gc version 4.1.0.\nThis vulnerability is triggered when the system processes a specially crafted request, leading to an instability or crash of the service.\nThe flaw resides in the handling logic of UE (User Equipment) context creation, which is a critical function for managing subscriber sessions within the 5G core network architecture.\nAn attacker capable of communicating with the affected service can exploit this by injecting malicious or malformed request payloads.\nSuccessful exploitation results in the service becoming unavailable, thereby disrupting network connectivity for legitimate users dependent on the affected component.\nThe risk implication is significant as it directly impacts the availability of 5G core services, potentially causing widespread outage of data and signaling traffic for connected devices.\nNo specific authentication or high-level privilege requirements are explicitly stated, but the attack requires network access to the component interface.",
  "technicalDetails": "The vulnerability is localized to the CreateUEContext handler function within the free5gc core network architecture, specifically affecting version 4.1.0.\nThe root cause pertains to improper validation or error handling when parsing and processing incoming requests related to the establishment of a UE context.\nIn the context of the N1/N2 interface protocols, the CreateUEContext procedure is responsible for allocating resources and maintaining state information for a mobile subscriber.\nWhen a crafted request is received, the handler logic fails to properly sanitize or validate the input fields, or alternatively, enters an unhandled exception state when encountering unexpected data structures.\nThis leads to an application-level crash, forcing the process to terminate or hang, effectively creating a Denial of Service condition.\nThe attack flow involves an attacker sending a malformed protocol message, likely conforming to the expected interface format but containing anomalous data in specific fields that the handler component does not anticipate or cannot safely process.\nSince this component is central to 5G signaling, its failure prevents the successful setup or maintenance of PDU (Protocol Data Unit) sessions, meaning new users cannot attach to the network and existing sessions may become unresponsive.\nThe vulnerability highlights a lack of robustness in the input validation layer for 5G signaling messages, allowing for state corruption or memory access violations that trigger a service panic.\nBecause free5gc is a software-defined core network platform, the impact of such a crash is immediate, halting the processing of any incoming signaling messages handled by the service instance.\nThe attack can be performed remotely by any entity that can interact with the network interface where the CreateUEContext handler is exposed, making it a critical threat to network availability.\nThe technical failure suggests that the input parsing mechanism fails to adhere to strict schema validation, causing the downstream logic to act on invalid memory pointers or corrupted application states."
}