Description

An issue in the NGAP handler of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted NAS PDU.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-27T17:17:51.380Z",
  "pubdate": "2026-08-27T17:17:51.380Z",
  "executiveSummary": "This vulnerability is a Denial of Service (DoS) flaw identified within the NGAP (Next Generation Application Protocol) handler of the free5gc core network stack, specifically affecting version 4.0.1.\nThe issue stems from improper validation of NAS (Non-Access Stratum) Protocol Data Units (PDUs) encapsulated within NGAP messages. An unauthenticated attacker capable of interacting with the AMF (Access and Mobility Management Function) via the N2 interface can trigger a panic or service interruption.\nSuccessful exploitation results in the abnormal termination of the NGAP service, leading to a loss of signaling connectivity for all UEs (User Equipment) managed by the affected AMF instance.\nThis vulnerability poses a significant risk to the availability of the 5G core network, as it allows remote attackers to induce a system-wide service disruption without requiring prior authentication or administrative privileges.\nThe attack vector is restricted to network-level access where the attacker can send crafted NGAP packets to the free5gc AMF component.",
  "technicalDetails": "The vulnerability resides within the NGAP message processing logic of free5gc v4.0.1. Specifically, the flaw is triggered during the deserialization and subsequent handling of NAS PDUs that are encapsulated within the NAS-PDU Information Element (IE) of an NGAP message, such as an InitialUEMessage or UplinkNASTransport.\nThe root cause is identified as an incomplete input validation or an error-handling deficiency when the AMF attempts to parse a malformed or maliciously crafted NAS PDU. When the NGAP handler encounters an unexpected or syntactically invalid NAS PDU, it fails to handle the exception gracefully, leading to an unhandled runtime panic in the Go-based implementation of the free5gc core.\nThe exploitation flow proceeds as follows: 1) An attacker crafts an NGAP message containing an malformed NAS PDU structure. 2) The attacker transmits this packet to the AMF via the N2 interface. 3) The AMF’s NGAP handler receives the packet and passes the encapsulated NAS PDU to the NAS layer for processing. 4) Due to the lack of strict boundary checks or robust error handling for unexpected PDU formats, the application state enters an undefined condition, resulting in a segmentation fault or a runtime panic that terminates the NGAP handler thread or the entire AMF process.\nBecause the AMF is a critical component for mobility management, session establishment, and signaling, its sudden termination causes an immediate DoS condition for all connected UEs. The implementation lacks sufficient recovery mechanisms or panic-suppression logic that would otherwise allow the service to ignore the malformed message and continue normal operations.\nThe vulnerability does not require authentication, as the N2 interface is the primary entry point for gNodeB communication, and the AMF must process incoming NAS PDUs as part of the initial connection procedure. Consequently, the impact is severe, as it allows for the remote disruption of the 5G service architecture without the need for credentials or valid subscriber context.\nThe scope of impact is limited to the free5gc v4.0.1 software implementation. The behavior is deterministic; the same crafted input will reliably trigger the panic state, making it a stable vector for DoS attacks against deployed free5gc AMF instances."
}