CVE-2026-30067

free5GC v4.0.1 contains a denial-of-service flaw (CWE-770, allocation of resources without limits or throttling) in the complexQueryFilterSubprocess function of the NRF Discovery service. A remote, unauthenticated attacker can trigger it by sending crafted input to the network repository function's discovery interface, consistent with resource exhaustion on the affected service. Because the NRF handles service discovery and registration for 5G core network functions, a successful attack degrades availability of the 5G core and can disrupt dependent network services, with no confidentiality or integrity impact per the CVSS scoring. Organizations running free5GC v4.0.1 — typically research testbeds, academic labs, and private 5G network trials rather than mass-market carrier deployments — are affected. As of now there is no known exploitation, no public proof-of-concept, the flaw is not in CISA KEV, and EPSS puts 30-day exploitation probability at roughly 0.4%.

What to do: Organizations running free5GC v4.0.1 should track the free5GC project for a patched release and upgrade the NRF component promptly once a fix is published. In the interim, restrict network access to the NRF discovery interface to trusted management and 5G core networks, and monitor the NRF service for abnormal resource consumption or availability drops.