CVE-2026-44322

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-44322
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44322.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-44322
Aliases
Published
2026-05-27T15:46:10.475Z
Modified
2026-07-08T08:13:39.872142334Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
free5GC: NEF 3gpp-pfd-management PATCH applications/{appId} panics on UDR access failure due to nil ProblemDetails dereference
Details

free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's NEF PATCH /3gpp-pfd-management/v1/{afId}/transactions/{transId}/applications/{appId} handler panics with a nil-pointer dereference when the upstream UDR call fails AND the consumer wrapper returns err != nil together with a nil *ProblemDetails. The handler's errPfdData != nil branch builds its own problemDetailsErr correctly, but immediately after it reads problemDetails.Cause (the OTHER value, which is nil in this branch) and panics. Gin recovery converts the panic into HTTP 500, so a single PATCH against this endpoint returns 500 instead of the intended controlled error response whenever UDR access is failing. This vulnerability is fixed in 4.2.2.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44322.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-476",
        "CWE-754"
    ]
}
References

Affected packages

Git / github.com/free5gc/free5gc

Affected ranges

Type
GIT
Repo
https://github.com/free5gc/free5gc
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
8b0f4445fc931638fb624463ce3572a203517679
Database specific 
{
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ],
    "cpe": "cpe:2.3:a:free5gc:free5gc:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "4.2.2"
        }
    ]
}
Type
GIT
Repo
https://github.com/free5gc/nef
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
72a47f3fab4dffbd227f8d92c5f69dca93b610cb
Database specific 
{
    "source": "REFERENCES"
}

Affected versions

v1.*
v1.0.0
v1.0.1
v1.0.2
v1.1.0
v1.2.0
v1.2.1
v1.2.2
v3.*
v3.0.5
v3.0.6
v3.0.7
v3.1.0
v3.1.1
v3.2.0
v3.2.1
v3.3.0
v3.4.0
v3.4.1
v3.4.2
v3.4.3
v3.4.4
v3.4.5
v4.*
v4.0.0
v4.0.1
v4.1.0
v4.2.0
v4.2.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44322.json"