Skip to content
Heist/ feed
Back to feed
Medium

free5GC: UDR nudr-dr DELETE amf-subscriptions panics on missing subsId when UE state exists (nil pointer dereference)

Type: advisorySources: OSV

free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's UDR nudr-dr DELETE /subscription-data/{ueId}/{servingPlmnId}/ee-subscriptions/{subsId}/amf-subscriptions handler contains a nil-pointer dereference reachable from a single authenticated request, after one preparatory authenticated EE-subscription create. The handler checks _, ok = UESubsData.EeSubscriptionCollection[subsId] and sets a 404 problem-details on the miss path, but then continues to UESubsData.EeSubscriptionCollection[subsId].AmfSubscriptionInfos -- dereferencing the same missing entry instead of returning. Gin recovery converts the panic into HTTP 500, but the endpoint remains repeatedly panicable. This vulnerability is fixed in 4.2.2.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-44323
Confirmed fixed CVEs
Not specified
Updated in this feed
3 Nov 2026, 06:05 UTC · Revision 1

Source evidence

free5GC: UDR nudr-dr DELETE amf-subscriptions panics on missing subsId when UE state exists (nil pointer dereference)

core-osv · Original source

Published 27 May 2026, 15:45 UTC

free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's UDR nudr-dr DELETE /subscription-data/{ueId}/{servingPlmnId}/ee-subscriptions/{subsId}/amf-subscriptions handler contains a nil-pointer dereference reachable from a single authenticated request, after one preparatory authenticated EE-subscription create. The handler checks _, ok = UESubsData.EeSubscriptionCollection[subsId] and sets a 404 problem-details on the miss path, but then continues to UESubsData.EeSubscriptionCollection[subsId].AmfSubscriptionInfos -- dereferencing the same missing entry instead of returning. Gin recovery converts the panic into HTTP 500, but the endpoint remains repeatedly panicable. This vulnerability is fixed in 4.2.2.

osv:CVE-2026-44323
Complete source record
{
  "id": "d40913d1c54301b4fcc6fc800b0e60b56101cfe660655e66cc42ac334a019c18",
  "url": "https://osv.dev/vulnerability/CVE-2026-44323",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "free5GC: UDR nudr-dr DELETE amf-subscriptions panics on missing subsId when UE state exists (nil pointer dereference)",
    "summary": "free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's UDR nudr-dr DELETE /subscription-data/{ueId}/{servingPlmnId}/ee-subscriptions/{subsId}/amf-subscriptions handler contains a nil-pointer dereference reachable from a single authenticated request, after one preparatory authenticated EE-subscription create. The handler checks _, ok = UESubsData.EeSubscriptionCollection[subsId] and sets a 404 problem-details on the miss path, but then continues to UESubsData.EeSubscriptionCollection[subsId].AmfSubscriptionInfos -- dereferencing the same missing entry instead of returning. Gin recovery converts the panic into HTTP 500, but the endpoint remains repeatedly panicable. This vulnerability is fixed in 4.2.2.",
    "evidence": "osv:CVE-2026-44323",
    "products": [],
    "severity": "medium",
    "structured": {
      "id": "CVE-2026-44323",
      "aliases": [
        "CVE-2026-44323",
        "GHSA-4rqf-grm6-vf75",
        "GO-2026-5131"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/free5gc/free5gc",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "8b0f4445fc931638fb624463ce3572a203517679"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "4.2.2"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StringRangeExpression"
                  },
                  {
                    "cpe": "cpe:2.3:a:free5gc:free5gc:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "4.2.2"
                      }
                    ],
                    "source": "CPE_RANGE"
                  }
                ]
              }
            },
            {
              "repo": "https://github.com/free5gc/udr",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "8a1d3c63be99d378806d771f086ff32f1867da99"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "fixed": "8a1d3c63be99d378806d771f086ff32f1867da99"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v4.2.1",
            "v4.2.0",
            "v4.1.0",
            "v4.0.1",
            "v4.0.0",
            "v3.4.5",
            "v3.4.4",
            "v3.4.3",
            "v3.4.2",
            "v3.4.1",
            "v3.4.0",
            "v3.3.0",
            "v3.2.1",
            "v3.2.0",
            "v3.1.1",
            "v3.1.0",
            "v3.0.7",
            "v3.0.6",
            "v3.0.5",
            "v1.4.2",
            "v1.4.1",
            "v1.4.0",
            "v1.3.2",
            "v1.3.1",
            "v1.3.0",
            "v.1.2.5",
            "v1.2.4",
            "v1.2.3",
            "v1.2.2",
            "v1.2.1",
            "v1.2.0",
            "v1.1.1",
            "v1.1.0",
            "v1.0.2",
            "v1.0.1",
            "v1.0.0"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44323.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:26.347395908Z",
      "provider": "osv",
      "references": [
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44323.json",
        "https://github.com/free5gc/free5gc/security/advisories/GHSA-4rqf-grm6-vf75",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-44323",
        "https://github.com/free5gc/free5gc/issues/919",
        "https://github.com/free5gc/udr/commit/8a1d3c63be99d378806d771f086ff32f1867da99",
        "https://github.com/free5gc/udr/pull/60"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-476"
        ],
        "cna_assigner": "GitHub_M",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44323.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-44323",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 492928,
  "published_at": "2026-05-27T15:45:14.218+00:00"
}