8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-33063

CVE-2026-33063: free5GC AUSF UE Authentication Panic on Nil SuciSupiMap Interface Conversion

free5GC is an open source 5G core network. free5GC AUSF prior to version 1.4.2 has is an Improper Null Check vulnerability leading to Denial of Service. All deployments of free5GC v4.0.1 using the AUSF UE authentication service (/nausf-auth/v1/ue-authentications endpoint) are affected. A remote attacker can cause the AUSF service to panic and crash by sending a crafted UE authentication request that triggers a nil interface conversion in the GetSupiFromSuciSupiMap function. This results in complete denial of service for the AUSF authentication service. The GetSupiFromSuciSupiMap function attempts to perform an interface conversion from interface{} to *context.SuciSupiMap without checking if the underlying value is nil. When SuciSupiMap is nil, the code panics with "interface conversion: interface {} is nil, not *context.SuciSupiMap". free5GC AUSF version 1.4.2 patches the issue. There is no direct workaround at the application level. The recommendation is to apply the provided patch or restrict access to the AUSF API to trusted sources only.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-33063

CVE-2026-33063:

8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/free5gc/ausf	go	< 1.4.2	1.4.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a denial of service in the free5GC AUSF component, caused by a nil pointer dereference. The analysis of the provided information, including the vulnerability description and the patch, identified two key functions involved in the vulnerability.

UeAuthPostRequestProcedure in internal/sbi/processor/ue_authentication.go: This function is the entry point for handling UE authentication requests. The patch 3b9ac4403c2756dc89a5ed3cdcefe688458588aa modifies this function to add checks before calling GetSupiFromSuciSupiMap. This indicates that UeAuthPostRequestProcedure was the function that was processing the malicious input and would be present in any runtime profile during exploitation.
GetSupiFromSuciSupiMap in internal/context/context.go: The vulnerability description explicitly names this function as the place where the panic occurs due to an improper nil check before an interface conversion. Although the patch is not in this function, it is the root cause of the crash. The patch in UeAuthPostRequestProcedure is a mitigation to prevent this function from being called with invalid data.

Therefore, both functions are critical to understanding and identifying this vulnerability. UeAuthPostRequestProcedure is the function that receives the malicious input, and GetSupiFromSuciSupiMap is the function that contains the vulnerable code that causes the service to crash.

Vulnerable functions

UeAuthPostRequestProcedure

internal/sbi/processor/ue_authentication.go

This function processes UE authentication requests and, before the patch, it would call `GetSupiFromSuciSupiMap` without ensuring that the `suciSupiPair` exists. A crafted request could lead to a nil value being passed, causing a panic in the called function. This function would be at the top of the stack trace during exploitation.

GetSupiFromSuciSupiMap

internal/context/context.go

This function is where the actual panic occurs. It performs a type assertion on an interface without checking if it's nil. When `UeAuthPostRequestProcedure` calls this function with a value from a non-existent `suciSupiPair`, it triggers a panic, leading to a denial of service. The file path is inferred based on the package name `ausf_context`.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.