free5GC NRF contains an improper input validation flaw in the EncodeGroupId function that reads array indices [0], [1], and [2] without verifying the split data length. When the group-id-list HTTP parameter has insufficient separator characters, the function panics with an "index out of range" error. The resulting crash brings down the NRF discovery service, causing a complete interruption of service for the 5G core network. The weakness is classified as improper access control leading to denial of service (CWE-284).

All free5GC NRF installations using the discovery service are affected. The issue exists in versions prior to free5GC NRF 1.4.2. Upgrade to version 1.4.2 or later resolves the vulnerability.

The CVSS score of 8.7 signals a high severity, and the EPSS score of less than 1% suggests a low probability of exploitation at current time. The attack vector is remote, requiring only an HTTP GET request to the NRF API with a crafted group-id-list parameter. No local privileges are needed. An attacker can cause the NRF service to crash and deny service to the network operator. The vulnerability is not listed in CISA’s KEV catalog, but its availability and service disruption impact make it significant for operators.