CVE-2026-44319: free5GC: NEF crashes via logger.Fatal on PFD notification delivery failure (attacker-controlled notifyUri)

Synopsis

This is a process-termination vulnerability in the Network Exposure Function (NEF) component of free5GC, an open-source 5G core network implementation. The flaw is reachable over the network without any authentication: an attacker creates a PFD subscription with an attacker-chosen callback URL (notifyUri), then triggers a PFD change event, causing the NEF process to call logger.Fatal on delivery failure, which is equivalent to os.Exit(1) in Go and immediately kills the process. Successful exploitation crashes the NEF entirely, dropping all its Service-Based Interface (SBI) traffic until the process is manually restarted. A fix was introduced in free5GC 4.2.2; patched-image rebuilds at that version are available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the NEF's SBI endpoint over the network to create a PFD subscription with a crafted notifyUri.

• AuthenticationNot required

  No credentials are required; the CVSS vector specifies PR:N, meaning the subscription creation endpoint can be abused without any account.

• Victim interactionNot required

  No human interaction is needed; the attacker controls both the subscription creation and the PFD change trigger, making the crash fully self-contained.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is reliable and requires no special timing, race conditions, or environmental preconditions beyond the ability to register a PFD subscription.

Blast Radius

• The NEF process exits immediately with status 1, taking down the entire SBI surface the NEF exposes to other 5G core functions.
• All in-flight and queued SBI requests to the NEF are dropped at the moment of the crash, disrupting any function relying on network exposure services.
• The outage persists until an operator or orchestration layer detects the process death and restarts the NEF, creating a window of complete unavailability.
• No confidentiality or integrity impact is associated with this vulnerability; the attacker gains only the ability to force this denial of service.