CVE-2026-44317: free5GC: PCF npcf-policyauthorization POST /app-sessions panics on suppFeat=1 with missing AfRoutReq via nil pointer dereference

Vulnerability summary

CVE-2026-44317 is a medium (CVSS 6.5) NULL Pointer Dereference vulnerability in free5gc. EPSS estimates a 0.58% chance of exploitation in the next 30 days, higher than 47.1% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 27-05-2026
   PublishedVulnerability first disclosed.
2. 28-05-2026
   Last modifiedVulnerability information updated.

Description

free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's PCF POST /npcf-policyauthorization/v1/app-sessions handler panics on a single authenticated request whose ascReqData.suppFeat == "1" (enabling traffic-routing feature negotiation) and whose medComponents entries supply an afAppId but NO AfRoutReq. The create path then calls provisioningOfTrafficRoutingInfo(smPolicy, appID, routeReq, ...) with routeReq == nil and dereferences routeReq.RouteToLocs (and other fields) without a nil check, causing runtime error: invalid memory address or nil pointer dereference. Gin recovery converts the panic into HTTP 500. This vulnerability is fixed in 4.2.2.

• CWE-476NULL Pointer DereferenceThe product dereferences a pointer that it expects to be valid but is NULL.
• CWE-754Improper Check for Unusual or Exceptional ConditionsThe product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.