CVE-2026-44318

free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's BSF PUT /nbsf-management/v1/subscriptions/{subId} handler has an unsynchronized write on the global Subscriptions map. The handler first reads the map under RLock() via BSFContext.GetSubscription(subId), but if the subscription does not exist, ReplaceIndividualSubcription() writes back to the same map directly without taking the mutex (bsfContext.BsfSelf.Subscriptions[subId] = subscription). Under concurrent authenticated PUT load, one goroutine can read while another writes the map, which causes the Go runtime to abort the process with fatal error: concurrent map read and map write (Go runtime panics that come from concurrent map access bypass recover() and terminate the process). The BSF container exits with code 2 -- the entire BSF SBI surface goes down until restart. This vulnerability is fixed in 4.2.2.

• CWE-362
• CWE-820

• https://github.com/free5gc/bsf/commit/277908565fd628d974a13ef562b81a8b7b519ffaPatch
• https://github.com/free5gc/bsf/pull/7Issue Tracking, Patch
• https://github.com/free5gc/free5gc/issues/926Exploit, Issue Tracking
• https://github.com/free5gc/free5gc/security/advisories/GHSA-27ph-8q4f-h7m7Exploit, Vendor Advisory
• https://github.com/free5gc/free5gc/issues/926Exploit, Issue Tracking
• https://github.com/free5gc/free5gc/security/advisories/GHSA-27ph-8q4f-h7m7Exploit, Vendor Advisory

Published

May 27, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-44312css_parser is a Ruby CSS parser. Prior to 2.1.0 and 1.22.0, …5.8
• CVE-2026-44313Linkwarden is a self-hosted, open-source collaborative bookm…9.1
• CVE-2026-44314Traccar is an open source GPS tracking system. Prior to 6.13…4.3
• CVE-2026-44315free5GC is an open-source implementation of the 5G core netw…9.4
• CVE-2026-44316free5GC is an open-source implementation of the 5G core netw…7.5
• CVE-2026-44317free5GC is an open-source implementation of the 5G core netw…6.5
• CVE-2026-44319free5GC is an open-source implementation of the 5G core netw…7.5
• CVE-2026-4432The YITH WooCommerce Wishlist WordPress plugin before 4.13.0…6.5
• CVE-2026-44320free5GC is an open-source implementation of the 5G core netw…7.3
• CVE-2026-44321free5GC is an open-source implementation of the 5G core netw…7.5
• CVE-2026-44322free5GC is an open-source implementation of the 5G core netw…7.5
• CVE-2026-44323free5GC is an open-source implementation of the 5G core netw…6.5