CVE-2026-55784

free5GC, an open-source implementation of the 5G core network, contains a race condition (CWE-362) in its AUSF authentication component in version 1.4.4 and earlier: per-subscriber authentication contexts are stored in a global map (AUSFContext.UePool) keyed only by SUPI, and each new authentication request unconditionally overwrites the active context for that subscriber. An attacker with access to the AUSF SBI/N12 interface can trigger the flaw by sending concurrent POST /nausf-auth/v1/ue-authentications requests for the same target SUPI, forcing all attempts to share one logical context while cryptographic values (K_aut, XRES, EapID) are repeatedly overwritten. A valid EAP-AKA' response for an earlier challenge is then checked against the latest overwritten context, the AT_MAC verification fails, and the targeted subscriber is denied authentication for as long as the flood continues — a network-reachable denial of service with no confidentiality or integrity impact. Anyone running free5GC 1.4.4 or earlier whose AUSF interface is reachable by other network functions or external actors is affected. There is no public proof-of-concept, no entry in CISA's KEV, and a low predicted exploitation probability (EPSS 0.3%), and no fixed version is available as of this review.

What to do: No patched release exists yet, so monitor the free5GC repository for a fixed version and upgrade as soon as one ships. Until then, restrict access to the AUSF SBI/N12 interface to trusted network functions and rate-limit or avoid issuing concurrent ue-authentication requests for the same SUPI. Investigate clusters of repeated EAP-AKA'/AT_MAC authentication failures for a single subscriber, as these are the telltale sign of this attack.