EUVD-2026-67121
GHSA-wrx5-c5q7-gp38
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-exposed SBI endpoint, no auth required (PR:N), no complexity beyond crafted request; impact is pure availability with no confidentiality or integrity effect.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
5DescriptionCVE.org
An issue in the NssaiAvailabilitySubscriptionCreate component of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
AnalysisAI
Denial of Service in free5gc v4.0.1 allows unauthenticated remote attackers to crash the NSSF (Network Slice Selection Function) by sending a crafted POST request to the NssaiAvailabilitySubscriptionCreate endpoint. The affected component handles 5G network slice subscription lifecycle management, and resource exhaustion causes the NSSF to become unresponsive, disrupting slice selection for all connected 5G devices on that core instance. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network-level reachability to the free5gc NSSF service, which listens on the 5G Service-Based Interface - an internal network interface typically accessible only to trusted core NFs, not the public internet. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects unauthenticated, low-complexity network exploitation with complete availability impact to the affected component - signals that would normally warrant urgent attention. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patched version has been independently confirmed from available data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all free5gc v4.0.1 deployments and assess their exposure to untrusted remote networks; implement network-level access controls restricting the NssaiAvailabilitySubscriptionCreate endpoint to trusted control-plane nodes only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today