Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/free5gc/bsf | go | < 1.0.2 | 1.0.2 |
Miggo AIRoot Cause AnalysisThe analysis of the vulnerability and the provided patch confirms that the root cause is a race condition in the ReplaceIndividualSubcription function located in internal/sbi/processor/subscriptions.go. The vulnerability description explicitly points out an unsynchronized write to a shared map. The provided commit patch corroborates this by removing the code block responsible for creating a new subscription if it doesn't exist. Specifically, the lines bsfContext.BsfSelf.Subscriptions[subId] = subscription were removed from the else block that executes when a subscription is not found. This direct map write, performed without a mutex lock, is the source of the race condition when executed concurrently with read operations that are protected by a read lock. The exploit scenario involves sending multiple concurrent PUT requests with new subscription IDs, which triggers the vulnerable code path, causing the Go runtime to detect the concurrent access and terminate the process. Therefore, the function github.com/free5gc/bsf/internal/sbi/processor.ReplaceIndividualSubcription is identified as the vulnerable function.
github.com/free5gc/bsf/internal/sbi/processor.ReplaceIndividualSubcriptioninternal/sbi/processor/subscriptions.go