EUVD-2026-19241Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability was identified in Free5GC 4.2.0. This affects an unknown function of the component NGSetupRequest Handler. Such manipulation leads to denial of service. The attack may be launched remotely. The exploit is publicly available and might be used.
AnalysisAI
Denial of service in Free5GC 4.2.0 NGSetupRequest Handler allows unauthenticated remote attackers to crash the AMF (Access and Mobility Management Function) component via malformed requests. The vulnerability has a publicly available exploit and a vendor-released patch, with EPSS score of 5.3 indicating moderate but real exploitation risk despite low CVSS scoring.
Technical ContextAI
Free5GC is an open-source 5G core network implementation. The vulnerability resides in the NGSetupRequest Handler of the AMF (Access and Mobility Management Function), a critical component responsible for handling NG interface signaling messages from gNodeB (5G base stations). CWE-404 (Improper Resource Validation) indicates the handler fails to properly validate or handle certain request structures, leading to resource exhaustion or uncontrolled process termination. The NG interface is an unauthenticated, remotely accessible network boundary in the 5G architecture, making this particularly significant. The exploit configuration file (amfcfg.yaml) suggests the attack leverages malformed or crafted NG setup messages to trigger unhandled exceptions or resource depletion.
RemediationAI
Vendor-released patch available via upstream PR https://github.com/free5gc/amf/pull/201. Users should upgrade to the patched AMF version from the main Free5GC repository (https://github.com/free5gc/free5gc/). Immediate mitigation prior to patching includes implementing network-level access controls to restrict NG interface connectivity to trusted gNodeB sources only, and rate-limiting NGSetupRequest message handling to reduce denial of service surface. Detailed patch application instructions are available in the referenced GitHub pull request.
An improper input validation and protocol compliance vulnerability in free5GC v4.0.1 allows remote attackers to cause a
An array index out of bounds vulnerability in the AMF component of free5GC v4.0.1 allows remote attackers to cause a den
A heap buffer overflow vulnerability in the UPF component of free5GC v4.0.1 allows remote attackers to cause a denial of
An issue was discovered in Free5GC v4.0.0 and v4.0.1 allowing an attacker to cause a denial of service via crafted POST
An issue was discovered in free5GC version 3.3.0, allows remote attackers to execute arbitrary code and cause a denial o
Buffer Overflow vulnerability in free5gc 3.3.0 allows attackers to cause a denial of service via crafted PFCP messages w
Buffer Overflow vulnerability in free5gc 3.3.0 allows attackers to cause a denial of service via crafted PFCP message wi
Buffer Overflow vulnerability in free5gc 3.3.0, UPF 1.2.0, and SMF 1.2.0 allows attackers to cause a denial of service v
In Free5gc v3.0.5, the AMF breaks due to malformed NAS messages. Rated high severity (CVSS 7.5), this vulnerability is r
Free5gc v3.2.1 is vulnerable to Information disclosure. Rated high severity (CVSS 7.5), this vulnerability is remotely e
Cross-Site Request Forgery vulnerability, whose exploitation could allow an attacker to perform different actions on the
An issue in Free5gc v.3.3.0 allows a local attacker to cause a denial of service via the free5gc-compose component. Rate
Same weakness CWE-404 – Improper Resource Shutdown or Release
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today