CVE-2026-41135

CVE-2026-41135 is a memory leak vulnerability affecting free5GC UDR (Policy Control Function) versions prior to 1.4.3, an open-source 5G mobile core network implementation. The flaw exists in the OAM endpoint where improper CORS middleware registration causes uncontrolled memory growth through repeated HTTP requests. An unauthenticated attacker with network access to the PCF SBI interface can exploit this vulnerability to exhaust system memory and trigger denial of service conditions. The vulnerability presents a high severity risk with a CVSS score of 7.5. It requires no authentication or user interaction and can be exploited over the network with low complexity. The attack results in complete availability impact, preventing Policy Control Function operations and blocking all 5G session establishment, UE policy provisioning, and network service delivery. There is currently no evidence of active exploitation in the wild, and the vulnerability does not appear on CISA's Known Exploited Vulnerabilities list. The EPSS score of 0.00041 indicates a relatively low probability of exploitation despite the high severity rating. Patched version 1.4.3 is available and should be deployed immediately to mitigate this denial of service risk in operational 5G environments.