free5GC AUSF CVE-2026-53551

The AUSF POST /nausf-auth/v1/ue-authentications endpoint must be network-reachable - no authentication credentials are required (PR:N per CVSS 4.0 vector, consistent with the advisory's explicit 'None required' authentication rating). The default free5GC Docker deployment exposes this endpoint without access controls, making the attack viable against an out-of-box installation with no configuration changes. What limits exploitation in practice: the AUSF SBI interface is typically bound to an internal Docker bridge network (e.g., 172.24.0.0/16 in the reference environment), so an attacker generally requires access to the internal 5G core network segment - achievable via a rogue UE with SBI visibility, a compromised core NF, or a misconfigured network perimeter. The attack does not require a valid subscriber identity; any string with a null byte in the supiOrSuci position triggers the failure. Go's memory safety prevents a process crash, so the service remains running but returns HTTP 500 for each malformed request.

The vendor-assigned CVSS 4.0 score of 6.9 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L) nominally reflects low availability impact to the vulnerable system, but this understates operational risk for 5G core operators: the AUSF is the sole authentication gateway in a 3GPP 5G SA core, meaning a sustained flood of malformed requests - achievable with the published PoC - can deny authentication to the entire subscriber base served by that network function. The 4.1% trigger rate from fuzzing confirms that sustaining the DoS requires only modest attack volume at the SBI port. No EPSS data was provided; no CISA KEV listing exists in the input data, suggesting this has not yet been confirmed as actively exploited in the wild. The information disclosure side-channel (internal net/url error strings and stack traces in HTTP 500 responses) is a secondary risk enabling backend fingerprinting. The absence of authentication requirements (PR:N, confirmed by both the CVSS 4.0 vector and advisory) and the no-configuration-change prerequisite mean the attacker bar is minimal. For operators running free5GC in production (research networks, private 5G, testbeds), this is a real priority; for default Docker lab deployments on isolated bridges, the practical blast radius depends on who can reach port 8000.

A publicly available Python PoC (embedded in the vendor advisory) demonstrates a minimal single-request reproduction: an attacker sends POST /nausf-auth/v1/ue-authentications with a JSON body containing ten consecutive null bytes in the supiOrSuci field to the AUSF SBI port. The AUSF parses the request without error, constructs a UDM URL embedding the null bytes, and net/url.Parse() immediately fails, returning HTTP 500 with an internal error message. By automating this at scale - easily achievable given the PoC - an attacker can saturate the AUSF's authentication processing capacity, causing all concurrent subscriber authentication attempts to time out or fail.