DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-53551: CVE-2026-53551: Improper Input Validation in free5GC Authentication Server Function (AUSF)

#security #cve #cybersecurity

CVE-2026-53551: Improper Input Validation in free5GC Authentication Server Function (AUSF)

Vulnerability ID: CVE-2026-53551
CVSS Score: 6.9
Published: 2026-07-31

Improper input validation of the supiOrSuci field in free5GC Authentication Server Function (AUSF) allows unauthenticated remote attackers to trigger an unhandled parsing exception, resulting in a Denial of Service (DoS) and internal stack trace exposure.

TL;DR

A null-byte input validation bug in free5GC AUSF crashes the authentication flow, causing Denial of Service for connecting subscribers.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-20
  • Attack Vector: Network (Unauthenticated)
  • CVSS v4.0: 6.9 (Medium)
  • Impact: Denial of Service (DoS)
  • Exploit Status: PoC available
  • CISA KEV Status: Not Listed

Affected Systems

  • free5gc
  • ausf
  • ausf: < 1.4.5 (Fixed in: 1.4.5)
  • free5gc: < 4.2.2 (Fixed in: 4.2.2)

Code Analysis

Commit: bfc4a10

fix: validate supi or suci

@@ -244,6 +244,18 @@ func (p *Processor) UeAuthPostRequestProcedure(c *gin.Context, updateAuthenticat
    var authInfoReq models.AuthenticationInfoRequest

    supiOrSuci := updateAuthenticationInfo.SupiOrSuci
+   if !validator.IsValidSupi(supiOrSuci) && !validator.IsValidSuci(supiOrSuci) {
+       logger.UeAuthLog.Warnf("invalid supiOrSuci in UE authentication request: %q", supiOrSuci)
+       problemDetails := models.ProblemDetails{
+           Title:  "Malformed request syntax",
+           Status: http.StatusBadRequest,
+           Detail: "supiOrSuci must be a valid SUPI or SUCI",
+           Cause:  "MALFORMED_SUPI_OR_SUCI",
+       }
+       c.Set(sbi.IN_PB_DETAILS_CTX_STR, problemDetails.Cause)
+       c.JSON(http.StatusBadRequest, problemDetails)
+       return
+   }
Enter fullscreen mode Exit fullscreen mode

Exploit Details

  • GitHub: Issue report detailing reproduction with 5g-fuzzer

Mitigation Strategies

  • Upgrade free5gc to 4.2.2 or higher
  • Upgrade AUSF to 1.4.5 or higher
  • Implement API Gateway string pattern restrictions
  • Isolate the AUSF SBI within a protected VLAN/subnetwork

Remediation Steps:

  1. Verify currently running version of free5gc and the AUSF microservice
  2. Download and compile AUSF version 1.4.5 or pull the updated docker container image
  3. Apply the updated configurations and restart the AUSF service
  4. Validate that POST requests containing null bytes inside the supiOrSuci parameter are safely rejected with HTTP 400 Bad Request

References

Read the full report for CVE-2026-53551 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)