Free5GC PCF suffers a memory‑leak flaw caused by registering a new CORS middleware on every request to the OAM endpoint. The leak grows the Gin router handler chain without bounds, eventually exhausting system memory and rendering the PCF incapable of delivering AM and SM policies. Because the PCF refuses to provide these policies, UEs cannot establish 5G sessions, effectively denying network service to all users.

Vendors: free5gc:pcf. All releases prior to version 1.4.3 are vulnerable. These versions can be found in the free5GC project's PCF component. The vulnerability was discovered in the open‑source PCF implementation; the fixed code was shipped in release 1.4.3.

CVSS score 7.5 signifies high impact; EPSS not available, and it is not listed in KEV, implying no known widespread exploitation. The flaw can be triggered by any unauthenticated attacker who can reach the PCF's SBI interface, making the vulnerability highly actionable. When an attacker repeatedly sends requests, the PCF can be pushed into a DoS state quickly, because the attack does not require privileged access and relies on a simple HTTP interface.