CVE-2026-1684
📋 TL;DR
A denial-of-service vulnerability exists in Free5GC SMF's PFCP UDP Endpoint component, specifically in the HandleReports function. Attackers can remotely trigger this vulnerability to crash the SMF service, disrupting 5G core network functionality. Organizations running Free5GC SMF versions up to 4.1.0 are affected.
💻 Affected Systems
- Free5GC SMF
📦 What is this software?
Free5gc by Free5gc
⚠️ Risk & Real-World Impact
Worst Case
Complete disruption of 5G core network services, preventing subscriber connectivity and network operations until service restoration.
Likely Case
Service interruption affecting multiple subscribers, requiring manual restart of SMF components and causing temporary service outages.
If Mitigated
Limited impact with proper network segmentation and monitoring, allowing quick detection and recovery.
🎯 Exploit Status
Remote exploitation requires network access to PFCP UDP port (default 8805).
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.1.1 or later
Vendor Advisory: https://github.com/free5gc/free5gc/issues/806
Restart Required: Yes
Instructions:
1. Update Free5GC SMF to version 4.1.1 or later. 2. Apply the fix from GitHub PR #188. 3. Restart SMF service.
🔧 Temporary Workarounds
Network Segmentation
linuxRestrict access to PFCP UDP port (default 8805) to trusted network segments only.
iptables -A INPUT -p udp --dport 8805 -s TRUSTED_NETWORK -j ACCEPT
iptables -A INPUT -p udp --dport 8805 -j DROP
🧯 If You Can't Patch
- Implement strict network ACLs to limit PFCP UDP port access to authorized NFs only.
- Deploy rate limiting on PFCP UDP traffic to mitigate DoS attempts.
🔍 How to Verify
Check if Vulnerable:
Check SMF version: if version <= 4.1.0, system is vulnerable.Check Version:
grep -i version /path/to/smf/config/files or check deployment manifestsVerify Fix Applied:
Verify SMF version is >= 4.1.1 and check that GitHub PR #188 changes are applied.📡 Detection & Monitoring
Log Indicators:
- SMF service crashes
- PFCP session failures
- Unexpected termination of HandleReports function
Network Indicators:
- Unusual UDP traffic patterns on port 8805
- Multiple malformed PFCP messages from single source
SIEM Query:
source="smf.log" AND ("panic" OR "crash" OR "HandleReports")