CVE-2026-44318— free5GC: BSF concurrent PUT /nbsf-management/v1/subscriptions/{subId} crashes the BSF process via concurrent map read/write on Subscriptions
Possible ATT&CK Techniques 2AI
T1059 · Command and Scripting Interpreter T1499 · Endpoint Denial of ServiceGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-44318
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
free5GC: BSF concurrent PUT /nbsf-management/v1/subscriptions/{subId} crashes the BSF process via concurrent map read/write on Subscriptions
Source: NVD (National Vulnerability Database)
Vulnerability Description
free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's BSF PUT /nbsf-management/v1/subscriptions/{subId} handler has an unsynchronized write on the global Subscriptions map. The handler first reads the map under RLock() via BSFContext.GetSubscription(subId), but if the subscription does not exist, ReplaceIndividualSubcription() writes back to the same map directly without taking the mutex (bsfContext.BsfSelf.Subscriptions[subId] = subscription). Under concurrent authenticated PUT load, one goroutine can read while another writes the map, which causes the Go runtime to abort the process with fatal error: concurrent map read and map write (Go runtime panics that come from concurrent map access bypass recover() and terminate the process). The BSF container exits with code 2 -- the entire BSF SBI surface goes down until restart. This vulnerability is fixed in 4.2.2.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
使用共享资源的并发执行不恰当同步问题(竞争条件)
Source: NVD (National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-44318
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-44318
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-44318 (2)
Vendor Advisories for CVE-2026-44318 (1)
Other References for CVE-2026-44318 (1)
Same Patch Batch · free5gc · 2026-05-27 · 20 CVEs total
| CVE-2026-44330 | 10.0 CRITICAL | free5GC: NEF nnef-pfdmanagement API is unauthenticated; forged bearer tokens can read PFD |
| CVE-2026-44327 | 10.0 CRITICAL | free5GC: NEF nnef-oam route group is unauthenticated; no-token requests reach the OAM hand |
| CVE-2026-44329 | 10.0 CRITICAL | free5GC: SMF UPI management interface lacks auth middleware; unauthenticated topology read |
| CVE-2026-44326 | 9.4 CRITICAL | free5GC: NEF 3gpp-traffic-influence API is unauthenticated; missing or forged bearer token |
| CVE-2026-44315 | 9.4 CRITICAL | free5GC: NEF 3gpp-pfd-management API is unauthenticated; forged bearer tokens can create, |
| CVE-2026-42083 | 8.2 HIGH | free5GC: PCF Npcf_SMPolicyControl missing authentication middleware allows unauthenticated |
| CVE-2026-44328 | 8.2 HIGH | free5GC: SMF UPI DELETE /upi/v1/upNodesLinks/{ref} panics on AN-node deletion via nil UPF |
| CVE-2026-44325 | 7.5 HIGH | free5GC: NRF POST /oauth2/token structured-form parser type-confusion panic family (Reflec |
| CVE-2026-44322 | 7.5 HIGH | free5GC: NEF 3gpp-pfd-management PATCH applications/{appId} panics on UDR access failure d |
| CVE-2026-44321 | 7.5 HIGH | free5GC: SMF UPI POST /upi/v1/upNodesLinks exits the SMF process on overlapping UE pools ( |
| CVE-2026-44319 | 7.5 HIGH | free5GC: NEF crashes via logger.Fatal on PFD notification delivery failure (attacker-contr |
| CVE-2026-44316 | 7.5 HIGH | free5GC: PCF npcf-smpolicycontrol POST /sm-policies panics on downstream UDR/OpenAPI 404 v |
| CVE-2026-44320 | 7.3 HIGH | free5GC: NEF nnef-callback route group is unauthenticated; forged callback requests are ac |
| CVE-2026-44324 | 6.5 MEDIUM | free5GC: UDR nudr-dr DELETE amf-subscriptions panics on missing UE state via nil interface |
| CVE-2026-44317 | 6.5 MEDIUM | free5GC: PCF npcf-policyauthorization POST /app-sessions panics on suppFeat=1 with missing |
| CVE-2026-42081 | 6.1 MEDIUM | free5GC: UE Security Capability bypass on NGAP PathSwitchRequest |
| CVE-2026-44323 | 4.3 MEDIUM | free5GC: UDR nudr-dr DELETE amf-subscriptions panics on missing subsId when UE state exist |
| CVE-2026-42082 | 3.7 LOW | free5GC: Missing Concurrent NAS SMC Validation During NGAP Handover |
| CVE-2026-42459 | free5GC: Improper Input Validation and Generation of Error Message Containing Sensitive In |
IV. Related Vulnerabilities
Same product: free5gc
- CVE-2026-42081
free5GC: UE Security Capability bypass on NGAP PathSwitchReq - CVE-2026-42082
free5GC: Missing Concurrent NAS SMC Validation During NGAP H - CVE-2026-42083
free5GC: PCF Npcf_SMPolicyControl missing authentication mid - CVE-2026-42459
free5GC: Improper Input Validation and Generation of Error M - CVE-2026-44315
free5GC: NEF 3gpp-pfd-management API is unauthenticated; for
Same vendor: free5gc
- CVE-2026-42081
free5GC: UE Security Capability bypass on NGAP PathSwitchReq - CVE-2026-42082
free5GC: Missing Concurrent NAS SMC Validation During NGAP H - CVE-2026-42083
free5GC: PCF Npcf_SMPolicyControl missing authentication mid - CVE-2026-42459
free5GC: Improper Input Validation and Generation of Error M - CVE-2026-44315
free5GC: NEF 3gpp-pfd-management API is unauthenticated; for
Same weakness: CWE-362
- CVE-2026-47270
pam_usb: strtok() race condition in multi-threaded PAM hosts - CVE-2026-48066
pam_usb: Thread-unsafe static pointer in log.c causes data r - CVE-2026-45090
Dalfox: Unauthenticated Remote DoS via Closed-Channel Write - CVE-2026-44443
Lumiverse: Sign-up nonce race condition allows unauthorized - CVE-2026-24199
NVIDIA Display Driver 竞争条件问题漏洞
V. Comments for CVE-2026-44318
No comments yet