---
cve: "CVE-2026-44328"
severity: "HIGH"
cvss: 8.2
epss: "32%"
vendor: "Free5Gc"
kev: false
exploited: false
published: "2026-05-27 17:16:38"
tags: [cve, security, high]
source: tsecurity.de CVE-Dossier
exported: "2026-09-10T04:41:56+02:00"
---

# CVE-2026-44328

> 8.2 HIGH · 🧪 PoC

## Beschreibung

free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's SMF mounts the UPI management route group without inbound OAuth2 middleware. On top of that, the DELETE /upi/v1/upNodesLinks/{upNodeRef} handler unconditionally dereferences upNode.UPF after the type-guarded async release, even though AN-typed nodes are constructed without a UPF object. As a result, a single unauthenticated DELETE /upi/v1/upNodesLinks/gNB1 request crashes the handler with a nil-pointer panic AND mutates the in-memory user-plane topology before panicking (the UpNodeDelete(upNodeRef) line runs first). This is an unauthenticated, state-mutating panic-DoS sink that an off-path network attacker can trigger by name against any AN entry. This vulnerability is fixed in 4.2.2.

## CVSS-Vektor

```
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Keine | bad |
| UI Interaktion | Keine | bad |
| S Scope | Unverändert | good |
| C Vertraulichkeit | Keine | good |
| I Integrität | Gering | warn |
| A Verfügbarkeit | Hoch | bad |

## Patch verfügbar (OSV)

- 8b0f4445fc931638fb624463ce3572a203517679 (Commit)
- b57bc48081c3d3a2f333d02eb78e4fd31a120deb (Commit)

## Referenzen

- <https://github.com/free5gc/free5gc/security/advisories/GHSA-p9mg-74mg-cwwr>
- <https://github.com/free5gc/free5gc/issues/905>
- <https://github.com/free5gc/smf/pull/199>
- <https://github.com/free5gc/smf/commit/b57bc48081c3d3a2f333d02eb78e4fd31a120deb>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2026-44328) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_