CVE-2026-41135

Name of the Vulnerable Software and Affected Versions free5GC UDR versions prior to 1.4.3

Description A memory leak in the Policy Control Function (PCF) allows an unauthenticated attacker with network access to the PCF SBI interface to cause uncontrolled memory growth. By sending repeated HTTP requests to the 'OAM' endpoint, the attacker triggers a router.Use() call inside an HTTP handler that registers a new CORS middleware for every request, permanently expanding the Gin router handler chain. This results in progressive memory exhaustion and a Denial of Service, which prevents User Equipments (UEs) from obtaining Access and Mobility (AM) and Session Management (SM) policies, thereby blocking 5G session establishment.

Recommendations Update to version 1.4.3.