CVE-2026-44322

free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's NEF PATCH /3gpp-pfd-management/v1/{afId}/transactions/{transId}/applications/{appId} handler panics with a nil-pointer dereference when the upstream UDR call fails AND the consumer wrapper returns err != nil together with a nil *ProblemDetails. The handler's errPfdData != nil branch builds its own problemDetailsErr correctly, but immediately after it reads problemDetails.Cause (the OTHER value, which is nil in this branch) and panics. Gin recovery converts the panic into HTTP 500, so a single PATCH against this endpoint returns 500 instead of the intended controlled error response whenever UDR access is failing. This vulnerability is fixed in 4.2.2.

• CWE-476
• CWE-754

• https://github.com/free5gc/free5gc/issues/925Exploit, Issue Tracking
• https://github.com/free5gc/free5gc/security/advisories/GHSA-j59f-x285-69jxExploit, Vendor Advisory
• https://github.com/free5gc/nef/commit/72a47f3fab4dffbd227f8d92c5f69dca93b610cbPatch
• https://github.com/free5gc/nef/pull/22Issue Tracking, Patch
• https://github.com/free5gc/free5gc/security/advisories/GHSA-j59f-x285-69jxExploit, Vendor Advisory

Published

May 27, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-44317free5GC is an open-source implementation of the 5G core netw…6.5
• CVE-2026-44318free5GC is an open-source implementation of the 5G core netw…5.3
• CVE-2026-44319free5GC is an open-source implementation of the 5G core netw…7.5
• CVE-2026-4432The YITH WooCommerce Wishlist WordPress plugin before 4.13.0…6.5
• CVE-2026-44320free5GC is an open-source implementation of the 5G core netw…7.3
• CVE-2026-44321free5GC is an open-source implementation of the 5G core netw…7.5
• CVE-2026-44323free5GC is an open-source implementation of the 5G core netw…6.5
• CVE-2026-44324free5GC is an open-source implementation of the 5G core netw…6.5
• CVE-2026-44325free5GC is an open-source implementation of the 5G core netw…7.5
• CVE-2026-44326free5GC is an open-source implementation of the 5G core netw…9.4
• CVE-2026-44327free5GC is an open-source implementation of the 5G core netw…10
• CVE-2026-44328free5GC is an open-source implementation of the 5G core netw…8.2