The vulnerability resides in free5GC’s BSF component, where a concurrent PUT request to /nbsf-management/v1/subscriptions/{subId} performs an unsynchronized write to the global Subscriptions map. The handler first reads the map under a read lock but, when the subscription is missing, writes to the same map without acquiring the mutex. Concurrent authenticated PUT traffic can trigger a race between the read lock and the unsynchronized write, causing the Go runtime to panic with a fatal error: concurrent map read and map write. This panic terminates the BSF process, resulting in the entire BSF service becoming unavailable until a restart.

Products affected are free5GC versions of the free5gc suite released before 4.2.2. The issue is tied to the free5gc free5gc component, specifically the BSF module. No other vendor products are listed.

The CVSS score of 6.5 categorizes the risk as medium. The EPSS score is not available, and the vulnerability has not been listed in the CISA KEV catalog. The likely attack vector is a targeted workload that floods the BSF endpoint with concurrent authenticated PUT requests, which is feasible for an attacker with legitimate access to the BSF API. Successful exploitation results in a service disruption rather than direct data compromise.