CVE-2026-26024 describes a denial-of-service vulnerability in free5GC SMF versions up to and including 1.4.1, where a malformed PFCP SessionReportRequest can cause the SMF to panic and terminate. This affects the Session Management Function of free5GC, an open-source 5G mobile core network project. Rated 7.5 HIGH on CVSS, this vulnerability is easily exploitable over the network without authentication, leading to a complete denial of service (availability impact). While no upstream fix is available, workarounds include restricting PFCP interface access to trusted IPs and dropping/inspecting malformed messages at the network edge. Currently, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage, indicating low current attention and exploitability.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 1.4.1CPE matchmatch criteria | cpe:2.3:a:free5gc:smf:*:*:*:*:*:go:*:* |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.