4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-44323

CVE-2026-44323: free5GC: UDR nudr-dr DELETE amf-subscriptions panics on missing subsId when UE state exists (nil pointer dereference)

free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's UDR nudr-dr DELETE /subscription-data/{ueId}/{servingPlmnId}/ee-subscriptions/{subsId}/amf-subscriptions handler contains a nil-pointer dereference reachable from a single authenticated request, after one preparatory authenticated EE-subscription create. The handler checks _, ok = UESubsData.EeSubscriptionCollection[subsId] and sets a 404 problem-details on the miss path, but then continues to UESubsData.EeSubscriptionCollection[subsId].AmfSubscriptionInfos -- dereferencing the same missing entry instead of returning. Gin recovery converts the panic into HTTP 500, but the endpoint remains repeatedly panicable. This vulnerability is fixed in 4.2.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-44323

CVE-2026-44323:

4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/free5gc/udr	go	< 1.4.3	1.4.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic nil pointer dereference in the Go-based free5GC UDR component. The analysis of the provided commit 8a1d3c63be99d378806d771f086ff32f1867da99 confirms the root cause described in the vulnerability report. The function RemoveAmfSubscriptionsInfoProcedure in internal/sbi/processor/event_amf_subscription_info_document.go is responsible for deleting AMF subscription information. The vulnerable version of the code failed to properly handle cases where a subscription ID (subsId) did not exist. Although it checked for the existence of the subsId in a map, it didn't stop execution if the ID was missing. Instead, it proceeded to access the (nil) map entry, causing a panic. The patch corrects this by adding a return statement, ensuring that the function exits early when the subscription is not found. The stack trace provided in the vulnerability description also points to (*Server).HandleRemoveAmfSubscriptionsInfo as the function that calls the vulnerable RemoveAmfSubscriptionsInfoProcedure, making it a key part of the execution flow that leads to the vulnerability.

Vulnerable functions

github.com/free5gc/udr/internal/sbi/processor.(*Processor).RemoveAmfSubscriptionsInfoProcedure

internal/sbi/processor/event_amf_subscription_info_document.go

The vulnerability lies in the `RemoveAmfSubscriptionsInfoProcedure` function. The original code checked if a `subsId` existed in the `UESubsData.EeSubscriptionCollection` map. If the `subsId` was not found, it would set a `ProblemDetails` variable but would not return. The code execution would continue, and in the next block, it would attempt to access `UESubsData.EeSubscriptionCollection[subsId]`, which is a nil pointer when the `subsId` does not exist. This access caused a nil pointer dereference, leading to a panic. The fix involves adding a `return` statement after handling the 'not found' case, thus preventing the dereference of the nil pointer.

github.com/free5gc/udr/internal/sbi.(*Server).HandleRemoveAmfSubscriptionsInfo

internal/sbi/api_datarepository.go

This function acts as the handler for the DELETE request and calls the vulnerable `RemoveAmfSubscriptionsInfoProcedure` function. While the primary vulnerability is in the called function, this handler is the entry point for triggering the panic from an HTTP request and would appear in the stack trace during exploitation.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.