EUVD-2026-83769
GHSA-xw42-gh9m-wv36
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Reachable over the control-plane network (AV:N, PR:N) but exploitation depends on winning a timing race (AC:H); impact is a Go panic crashing the AMF (A:H), with no confidentiality or integrity effect.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was determined in Free5GC up to 4.2.3. This vulnerability affects unknown code of the file /corefuzzer_deps/free5gc/NFs/amf/internal/gmm/handler.go of the component Gmm Handler. This manipulation causes race condition. The attack can be initiated remotely. Patch name: e323b01464355781b8b8d5dd695e05cbc00a62f2. To fix this issue, it is recommended to deploy a patch.
AnalysisAI
A race condition in the Free5GC AMF network function, affecting releases up to and including 4.2.3, allows remote attackers to interleave GMM/NAS signalling with SCTP-association teardown so that concurrent unsynchronised access to the AmfUe.RanUe map occurs, which in Go produces a fatal "concurrent map read and map write" runtime error and crashes the AMF, disrupting UE registration and NAS transport for all attached subscribers. Both the supplier's CVSS 4.0 vector (6.9) and our independent assessment treat the flaw as unauthenticated (PR:N) but timing-dependent, with reach limited to the private 5G control plane - a malicious or compromised gNB, or a UE capable of driving registration/transport signalling over the N2 interface - rather than the public internet, and only availability is demonstrably impacted (C:N/I:N/A:H); the supplied "Information Disclosure" tag is not substantiated by the code path. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the attacker to reach the AMF's GMM/NAS signaling path over the 5G N2 interface (NGAP over SCTP) - i.e., a malicious or compromised gNB, or a UE able to drive registration/transport signaling - which is a private control-plane network, not the public internet. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but modest-priority defect. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Deploy the upstream fix - free5gc/amf commit e323b01464355781b8b8d5dd695e05cbc00a62f2, merged via pull request https://github.com/free5gc/amf/pull/238 - which wraps every RanUe read and write in the new sync.RWMutex and replaces direct map indexing with the nil-safe GetRanUe accessor; because the reference is a source commit rather than a tagged release, no fixed release version number is independently confirmed, so verify the lock and accessor are actually present in the image or build tag you ship and rebuild the AMF from patched source if your distribution has not yet cut a release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Free5gc NRF 1.4.0 has an authorization bypass in access token generation that allows authenticated users to request toke
free5gc UDM provides Unified Data Management (UDM) for free5GC, an open-source project for 5th generation (5G) mobile co
free5GC is an open-source project for 5th generation (5G) mobile core networks. Versions up to and including 1.4.1 of fr
An improper input validation and protocol compliance vulnerability in free5GC v4.0.1 allows remote attackers to cause a
free5GC is an open-source project for 5th generation (5G) mobile core networks. free5GC go-upf versions up to and includ
free5GC go-upf is the User Plane Function (UPF) implementation for 5G networks that is part of the free5GC project. Vers
An array index out of bounds vulnerability in the AMF component of free5GC v4.0.1 allows remote attackers to cause a den
A heap buffer overflow vulnerability in the UPF component of free5GC v4.0.1 allows remote attackers to cause a denial of
free5gc UDM provides Unified Data Management (UDM) for free5GC, an open-source project for 5th generation (5G) mobile co
Remote attackers can inject control characters into the SUPI parameter of free5GC UDM versions up to 1.4.1, causing URL
free5GC SMF versions up to 1.4.1 crash when receiving malformed PFCP SessionReportRequest packets on UDP port 8805, allo
free5GC SMF versions up to 1.4.1 crash when processing malformed PFCP SessionReportRequest messages on the UDP/8805 inte
Same weakness CWE-362 – Race Condition
View allSame technique Race Condition
View allShare
External POC / Exploit Code
Leaving vuln.today