free5GC PCF CVE-2026-41135

Upgrade free5GC to version 1.4.3 or later, which includes the patch commit 599803b1b2eb4611e26d5216481ee142bce71a16 that relocates the router.Use() middleware registration outside the request handler to execute only once during application initialization. The patch is available at https://github.com/free5gc/pcf/commit/599803b1b2eb4611e26d5216481ee142bce71a16 and incorporated in the 1.4.3 release per the GitHub Security Advisory at https://github.com/free5gc/free5gc/security/advisories/GHSA-98cp-84m9-q3qp. For environments where immediate patching is not feasible, implement network-layer access controls to restrict PCF SBI interface exposure: deploy firewall rules permitting OAM endpoint access only from authorized management systems (specific IP addresses of legitimate O&M platforms), not general network access; configure the PCF behind a reverse proxy or API gateway with rate limiting on the OAM endpoint (limit requests per source IP to 10-20 per minute) to slow memory accumulation, though this only delays exhaustion rather than preventing it; monitor PCF memory consumption with alerts at 70-80% thresholds to enable preemptive restarts before service failure. Note that rate limiting provides limited protection since even low-rate sustained requests will eventually exhaust memory, and service restarts cause session disruption for all connected User Equipment, making them operationally expensive mitigation measures. Patching to 1.4.3 is the only complete remediation.