Vulnerability Description
free5GC is an open-source implementation of the 5G core network. In version 1.4.4 and earlier, the AUSF component stores per-subscriber authentication state in a global sync.Map named AUSFContext.UePool in internal/context/context.go, keyed only by SUPI. Every request handled by internal/sbi/processor/ue_authentication.go creates an AusfUeContext, and AddAusfUeContextToPool executes ausfContext.UePool.Store(ausfUeContext.Supi, ausfUeContext), unconditionally replacing the active context for that SUPI. An attacker with access to the AUSF SBI/N12 interface can send concurrent POST /nausf-auth/v1/ue-authentications requests for the same target SUPI, causing all attempts to share one logical authentication context URL while K_aut, XRES, and EapID are repeatedly overwritten. A valid EAP-AKA' response for an earlier challenge is then checked against the latest context, causing AT_MAC verification to fail and denying authentication to the selected subscriber while the request flood continues. No fixed version is available as of this review.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/free5gc/free5gc/security/advisories/GHSA-334q-h5g3-fpxv
- https://github.com/free5gc/free5gc/security/advisories/GHSA-334q-h5g3-fpxv
FAQ
What is CVE-2026-55784?
CVE-2026-55784 is a vulnerability with a CVSS score of 7.5 (HIGH). free5GC is an open-source implementation of the 5G core network. In version 1.4.4 and earlier, the AUSF component stores per-subscriber authentication state in a global sync.Map named AUSFContext.UePo...
How severe is CVE-2026-55784?
CVE-2026-55784 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-55784?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.