CVE-2026-53551

free5GC is an open-source implementation of the 5G core network. Prior to 1.4.5, the free5GC AUSF (Authentication Server Function) does not validate the supiOrSuci field in UE authentication requests. Null bytes (\x00) and other control characters pass through JSON parsing unchanged and are forwarded to the UDM in an unescaped URL path. This causes Go's net/url.Parse() to fail, returning HTTP 500 "System failure" and leaking internal stack traces. An unauthenticated attacker can trigger this at scale causing denial of service for all subscribers attempting authentication through the affected AUSF. This vulnerability is fixed in 1.4.5.

• CWE-20

• https://github.com/free5gc/ausf/commit/bfc4a10094dbacbd862baa4686829f3fcc06ce1e
• https://github.com/free5gc/ausf/pull/61
• https://github.com/free5gc/ausf/releases/tag/v1.4.5
• https://github.com/free5gc/free5gc/issues/1048
• https://github.com/free5gc/free5gc/releases/tag/v4.2.2
• https://github.com/free5gc/free5gc/security/advisories/GHSA-qj55-47fp-p62j
• https://github.com/free5gc/free5gc/security/advisories/GHSA-qj55-47fp-p62j

Published

Jul 31, 2026

Last Modified

Sep 8, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-53546Termix is a web-based server management platform with SSH te…9.6
• CVE-2026-53547Termix is a web-based server management platform with SSH te…8.8
• CVE-2026-53548Termix is a web-based server management platform with SSH te…9.6
• CVE-2026-53549Termix is a web-based server management platform with SSH te…7.7
• CVE-2026-5355A vulnerability has been found in Trendnet TEW-657BRM 1.00.1…8.8
• CVE-2026-53550js-yaml is a JavaScript YAML parser and dumper. Prior to 4.2…5.3
• CVE-2026-53552Goploy is an open-source automation deployment system. In ve…9.6
• CVE-2026-53553Goploy is an open-source automation deployment system. Prior…7.7
• CVE-2026-53554SQLBot is an intelligent Text-to-SQL system based on large l…7.3
• CVE-2026-53555SQLBot is an intelligent Text-to-SQL system based on large l…5.1
• CVE-2026-53556SQLBot is an intelligent Text-to-SQL system based on large l…6
• CVE-2026-53557SQLBot is an intelligent Text-to-SQL system based on large l…7.7