7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-44319

CVE-2026-44319: free5GC: NEF crashes via logger.Fatal on PFD notification delivery failure (attacker-controlled notifyUri)

free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's NEF terminates the entire process when a stored PFD-subscription notifyUri cannot be reached. In PfdChangeNotifier.FlushNotifications(), the notifier calls NnefPFDmanagementNotify(...) and on any delivery error invokes logger.PFDManageLog.Fatal(err), which is os.Exit(1)-equivalent in Go. An attacker who can create a PFD subscription with an attacker-chosen notifyUri and then trigger a PFD change can deterministically kill NEF on the asynchronous delivery attempt -- the process exits with status 1, dropping NEF's entire SBI surface until restart. This vulnerability is fixed in 4.2.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-44319

CVE-2026-44319:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable YesTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/free5gc/nef	go	< 1.2.3	1.2.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the free5GC NEF component's handling of PFD (Packet Flow Description) change notifications. An attacker can create a PFD subscription with a malicious notifyUri pointing to an unreachable endpoint. When a relevant change occurs, the NEF's PfdNotifyContext.FlushNotifications function attempts to send a notification. In vulnerable versions, a failure to connect to the attacker-controlled notifyUri would result in a call to logger.PFDManageLog.Fatal(). This function call immediately terminates the entire process by calling os.Exit(1), leading to a denial of service. The vulnerability is exploitable by an unauthenticated attacker due to separate authorization bypass issues. The patch in commit f110517b1189801950b50668a593398687049074 fixes this by replacing the Fatal log call with Errorf, which logs the delivery failure without crashing the service. Therefore, PfdNotifyContext.FlushNotifications is the key function that would be observed in a runtime profile during the exploitation of this vulnerability.

Vulnerable functions

PfdNotifyContext.FlushNotifications

internal/sbi/notifier/pfd_notifier.go

This function is responsible for sending PFD change notifications. In the vulnerable version, it launched a goroutine that would call `logger.PFDManageLog.Fatal()` if the notification delivery to the `notifyUri` failed. Since an attacker can control the `notifyUri` and make it unreachable, they could trigger this fatal error and cause the entire NEF process to terminate, resulting in a denial of service.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.