8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-33062

CVE-2026-33062: free5GC NRF Discovery EncodeGroupId Function Panics on Malformed group-id-list Parameter

free5GC is an open source 5G core network. free5GC NRF prior to version 1.4.2 has an Improper Input Validation vulnerability leading to Denial of Service. All deployments of free5GC using the NRF discovery service are affected. The EncodeGroupId function attempts to access array indices [0], [1], [2] without validating the length of the split data. When the parameter contains insufficient separator characters, the code panics with "index out of range". A remote attacker can cause the NRF service to panic and crash by sending a crafted HTTP GET request with a malformed group-id-list parameter. This results in complete denial of service for the NRF discovery service. free5GC NRF version 1.4.2 fixes the issue. There is no direct workaround at the application level. The recommendation is to apply the provided patch or restrict access to the NRF API to trusted sources only.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-33062

CVE-2026-33062:

8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/free5gc/nrf	go	< 1.4.2	1.4.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the free5gc/nrf service, where a specially crafted HTTP GET request with a malformed group-id-list or external-group-identity parameter can cause a denial of service. The root cause is improper input validation in the buildFilter function, located in internal/sbi/processor/nf_discovery.go. This function passes the user-provided parameter to the nrf_context.EncodeGroupId function without ensuring it is correctly formatted. The EncodeGroupId function, in turn, attempts to access array indices without verifying the array's length, which triggers an 'index out of range' panic when the input is malformed, crashing the service.

The patch addresses this by introducing validation within the buildFilter function. It adds a call to validator.ValidateGroupIdFormat to check the format of the group ID before it's passed to the vulnerable EncodeGroupId function. Additionally, the signature of buildFilter was changed to return an error, which is now handled by its caller, NFDiscoveryProcedure. This ensures that instead of crashing, the service returns a proper HTTP error. Consequently, processor.buildFilter is the primary function that would be observed in a runtime profile during an exploit attempt, as it is the function that directly handles the malicious input.

Vulnerable functions

processor.buildFilter

internal/sbi/processor/nf_discovery.go

The `buildFilter` function processes the `external-group-identity` and `group-id-list` query parameters. Before the patch, it passed the raw input to `nrf_context.EncodeGroupId` without validation. A malformed ID would cause `nrf_context.EncodeGroupId` to panic due to an 'index out of range' error. The patch adds a call to `validator.ValidateGroupIdFormat` to validate the input before it is processed by `EncodeGroupId`, thus preventing the panic.

processor.NFDiscoveryProcedure

internal/sbi/processor/nf_discovery.go

This function is the entry point for handling NF discovery requests. It calls `buildFilter` to process query parameters. The patch adds error handling for the `buildFilter` function call. If `buildFilter` returns an error due to invalid parameters, `NFDiscoveryProcedure` now returns a `400 Bad Request` response instead of allowing the application to panic and crash.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.