Technical impact
The vulnerability allows an attacker to send a UE authentication request containing null bytes in the supiOrSuci field. The input bypasses validation, propagates unchanged to the UDM through the URL path, and triggers Go’s url.Parse() to die. This results in an HTTP 500 "System failure" response and a stack trace leak. The weakness is a classic input‑validation flaw (CWE‑20). The impact is a denial of service to all subscribers while also exposing internal stack information.
Affected Systems
free5gc AUSF and the free5gc core stack, specifically versions released before 1.4.5; the vulnerability is fixed in free5gc AUSF 1.4.5 and the overall free5gc release 4.2.2.
Risk and Exploitability
With a CVSS score of 6.9 the severity is moderate–high. The EPSS score of less than 1 % indicates a very low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The attack requires only the ability to inject a null byte into the supiOrSuci field, which is available to any unauthenticated user that can place a request to the AUSF. If triggered at scale, all authentication attempts will receive HTTP 500 responses, effectively disabling subscriber authentication.
Github GHSA