free5GC’s Policy Control Function contains a nil pointer dereference in its POST /npcf-policyauthorization/v1/app-sessions endpoint. When an authenticated request carries a suppFeat value of "1" (enabling traffic‑routing feature negotiation) and includes afAppId entries without corresponding AfRoutReq, the code calls provisioningOfTrafficRoutingInfo with a nil routeReq parameter. The function then attempts to read routeReq.RouteToLocs without a nil check, causing a runtime panic. The Gin framework’s recovery logic turns this panic into an HTTP 500 response, resulting in a denial of service to the affected PCF instance for the duration of the error and potentially disrupting policy provisioning for the 5G core network.

The vulnerability exists in free5GC free5gc prior to version 4.2.2. Systems running earlier releases of the free5GC PCF component are affected, regardless of deployment environment. The issue is tied to the PCF service component responsible for policy authorization.

The CVSS score of 6.5 indicates a medium severity denial‑of‑service attack. No EPSS data are available, and the vulnerability is not currently listed in CISA’s KEV catalog, suggesting limited exploitation in the wild at this time. Attackers must possess valid credentials to access the PCF endpoint, implying an authenticated threat. Once authenticated, an attacker can trigger the panic by sending a single POST request that satisfies the described conditions, causing the PCF to return HTTP 500 and potentially impacting policy service availability for all subscriber sessions. Mitigation requires patching or a temporary workaround until an official fix is deployed.