free5GC’s Service Management Function mounts management routes without inbound OAuth2 authentication for versions before 4.2.2. The DELETE /upi/v1/upNodesLinks/{upNodeRef} handler performs an unconditional dereference of upNode.UPF after an asynchronous release guard. For AN‑typed nodes that were created without a UPF, the dereference results in a nil‑pointer panic. The operation also changes the in‑memory user‑plane topology before panicking, so state mutation occurs prior to the crash. As a result, a single unauthenticated DELETE request that targets an AN entry causes the SMF to crash and the topology to be altered, which is an unauthenticated, state‑mutating denial‑of‑service vulnerability.

The affected product is the free5GC open‑source core network stack, specifically the SMF component. All releases prior to version 4.2.2 are impacted, along with any deployments that do not enable OAuth2 protection on the UPI routes. Affected systems include any service that exposes the DELETE /upi/v1/upNodesLinks endpoint and accepts unfiltered requests.

The vulnerability carries a CVSS score of 8.2, indicating high severity, and the EPSS score is not available, but the lack of authentication makes it straightforward to exploit from any network point that can reach the SMF. Although the vulnerability is not listed in the CISA KEV catalog, its denial‑of‑service and state‑mutation characteristics render it a high‑priority issue. An off‑path attacker can issue a single HTTP DELETE request without credentials to induce the crash and modify the topology, leading to service interruption for the affected network elements.