Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/free5gc/smf | go | < 1.4.3 | 1.4.3 |
Miggo AIRoot Cause AnalysisThe vulnerability is a nil pointer dereference within the DeleteUpNodeLink function, located in the internal/sbi/api_upi.go file of the free5gc/smf repository. This function handles DELETE requests to the /upi/v1/upNodesLinks/{ref} endpoint. The core of the issue lies in the unconditional call to upNode.UPF.CancelAssociation(). When a request is made to delete a user plane node of type 'AN' (Access Network), the corresponding upNode object is constructed without a UPF (User Plane Function) object, making the upNode.UPF field nil. Consequently, the method call on the nil UPF field triggers a panic, crashing the handler. The fix, as seen in commit b57bc48081c3d3a2f333d02eb78e4fd31a120deb, was to move the upNode.UPF.CancelAssociation() call inside the conditional block that already checked if the node type was UPNODE_UPF, and added a further check to ensure upNode.UPF is not nil. This vulnerability is particularly severe because the UPI route group lacks authentication, allowing any unauthenticated attacker who can reach the SMF's Service-Based Interface (SBI) to trigger this denial-of-service condition and mutate the in-memory user-plane topology.
