CVE-2026-44315

Name of the Vulnerable Software and Affected Versions free5GC versions prior to 4.2.2

Description The Network Exposure Function (NEF) in free5GC mounts the '3gpp-pfd-management' API without inbound OAuth2 or bearer-token authorization. A network attacker with access to the Service Based Interface (SBI) can use forged or arbitrary bearer tokens to create, read, and delete PFD-management transaction states. This allows for the poisoning of policy state used by the Session Management Function (SMF) and User Plane Function (UPF) for traffic classification, leakage of application function policy data, and denial of service for legitimate application detection rules.

Technical details include:

Additionally, the route group remains reachable even if the ServiceList in the running configuration does not declare it, meaning the service cannot be disabled via this configuration setting.

Recommendations Update to version 4.2.2.