DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-55784: CVE-2026-55784: Concurrent Request Context Overwrite in free5GC AUSF

#security #cve #cybersecurity

CVE-2026-55784: Concurrent Request Context Overwrite in free5GC AUSF

Vulnerability ID: CVE-2026-55784
CVSS Score: 7.5
Published: 2026-08-28

A concurrency synchronization flaw (race condition) exists in the Authentication Server Function (AUSF) of the free5GC 5G core network implementation. In versions 1.4.4 and earlier, authentication contexts are stored in a global sync.Map keyed solely by the Subscriber Permanent Identifier (SUPI). If multiple concurrent authentication requests are received for the same SUPI, the active security parameters (such as keys and expected responses) are unconditionally overwritten, resulting in authentication failures for the legitimate user.

TL;DR

A critical concurrency vulnerability (CWE-362) in free5GC AUSF allows unauthenticated network attackers to cause a denial of service (DoS) for targeted subscribers by sending concurrent authentication requests that overwrite active cryptographic session contexts.

Technical Details

  • CWE ID: CWE-362
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • Impact: Availability (High)
  • Exploit Status: None / Concept Only

Affected Systems

  • free5GC AUSF
  • free5GC: <= 1.4.4 (Fixed in: Not patched)

Mitigation Strategies

  • Restrict network access to the AUSF Service-Based Interface (SBI) / N12 interface via strict network firewalls or Service Mesh access policies.
  • Implement rate limiting at the API gateway or proxy layer for /nausf-auth/v1/ue-authentications endpoint based on the SUPI request attribute.
  • Incorporate composite keying in the internal implementation of free5GC to key the active session pool by both SUPI and a unique Transaction/Session ID.

Remediation Steps:

  1. Review the internal free5GC code structure specifically inside internal/context/context.go and internal/sbi/processor/ue_authentication.go.
  2. Apply localized patches to prevent unconditional context replacement, such as adding active validation flags or converting the lookup map key to a compound identifier.
  3. Deploy mutual TLS (mTLS) configurations on the SBI to ensure only authentic Access and Mobility Management Functions (AMFs) can initiate authentication sessions.

References

Read the full report for CVE-2026-55784 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)