CVE-2026-1683
📋 TL;DR
A denial-of-service vulnerability exists in Free5GC SMF's PFCP handler that allows remote attackers to crash the service by sending specially crafted PFCP Session Report Request messages. This affects all Free5GC deployments using SMF versions up to 4.1.0. The vulnerability is remotely exploitable without authentication.
💻 Affected Systems
- Free5GC SMF
📦 What is this software?
Free5gc by Free5gc
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption of the SMF component, causing loss of 5G session management functionality and potential cascading failures in the 5G core network.
Likely Case
Service crashes requiring manual restart of SMF instances, leading to temporary service outages and degraded 5G network performance.
If Mitigated
Minimal impact with proper network segmentation and monitoring allowing quick detection and recovery.
🎯 Exploit Status
Exploit details are publicly available in GitHub issues and the vulnerability is simple to trigger.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in SMF version after 4.1.0 via pull request #188
Vendor Advisory: https://github.com/free5gc/free5gc/issues/804
Restart Required: Yes
Instructions:
1. Update Free5GC SMF to latest version. 2. Apply patch from pull request #188 if using older version. 3. Restart SMF service.
🔧 Temporary Workarounds
Network Segmentation
linuxRestrict access to PFCP interface (port 8805) to trusted NFs only
iptables -A INPUT -p udp --dport 8805 -s trusted_ip_range -j ACCEPT
iptables -A INPUT -p udp --dport 8805 -j DROP
🧯 If You Can't Patch
- Implement strict network ACLs to limit PFCP traffic to authorized NFs only
- Deploy monitoring and automated restart mechanisms for SMF service
🔍 How to Verify
Check if Vulnerable:
Check SMF version: if version <= 4.1.0 and PFCP interface is exposed, system is vulnerableCheck Version:
Check SMF configuration file or deployment manifest for version informationVerify Fix Applied:
Verify SMF version > 4.1.0 or check that patch from PR #188 is applied📡 Detection & Monitoring
Log Indicators:
- SMF service crashes
- PFCP Session Report Request handling errors
- Panic logs in SMF
Network Indicators:
- Unusual PFCP traffic patterns
- Multiple PFCP Session Report Requests from single source
SIEM Query:
source="smf.log" AND ("panic" OR "crash" OR "HandlePfcpSessionReportRequest")🔗 References
- https://github.com/free5gc/free5gc/issues/804
- https://github.com/free5gc/free5gc/issues/804#issue-3816086696
- https://github.com/free5gc/smf/
- https://github.com/free5gc/smf/pull/188
- https://vuldb.com/?ctiid.343476
- https://vuldb.com/?id.343476
- https://vuldb.com/?submit.739653
- https://vuldb.com/?submit.739654
