Resource exhaustion in Free5gc
CVE-2026-41135
free5GC UDR is the Policy Control Function (PCF) for free5GC, an an open-source project for 5th generation (5G) mobile core networks. A memory leak vulnerability in versions prior to 1.4.3 allows any unauthenticated attacker with network access to the PCF SBI interface to cause uncontrolled memory growth by sending repeated HTTP requests to the OAM endpoint. The root cause is a `router.Use()` call inside an HTTP handler that registers a new CORS middleware on every incoming request, permanently growing the Gin router's handler chain. This leads to progressive memory exhaustion and eventual Denial of Service of the PCF, preventing all UEs from obtaining AM and SM policies and blocking 5G session establishment. Version 1.4.3 contains a patch.
Vulnerability class: DoS (Denial of Service)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.005 (43.1th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 43rd percentile — 43.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.005 · newest: 0.005 · change: +0.000
Affected products
- Free5gc
- Free5gc Pcf — versions < 1.4.3
Weakness classification (CWE)
References
- github.com/free5gc/free5gc/security/advisories/GHSA-98cp-84m9-q3qp (Exploit, Vendor Advisory)
- github.com/free5gc/pcf/commit/599803b1b2eb4611e26d5216481ee142bce71a16 (Patch)
Frequently asked questions
- What is CVE-2026-41135?
- CVE-2026-41135 is a high-severity vulnerability in Free5gc, classified under Uncontrolled Resource Consumption. CVSS score: 7.5/10. Published 2026-04-22.
- How severe is CVE-2026-41135?
- High severity. CVSS v3 base score is 7.5 out of 10.