PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-30072 free5gc CVE debrief

A NULL pointer dereference vulnerability exists in the CDR processing path of free5gc v4.0.1. This allows attackers to cause a Denial of Service (DoS) by supplying a crafted payload. The vulnerability has a HIGH CVSS score of 7.5, indicating a significant threat. Organizations using free5gc v4.0.1 should be aware of this vulnerability and take steps to mitigate it, including reviewing system configurations, assessing potential exposure, and prioritizing patching or updates. The CVE record and NVD entry provide limited information about the vulnerability, so further investigation is needed to fully understand the impact and affected scope.

Vendor
free5gc
Product
free5gc
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-27
Original CVE updated
2026-08-31
Advisory published
2026-08-27
Advisory updated
2026-08-31

Who should care

Organizations using free5gc v4.0.1 should be aware of this vulnerability and take steps to mitigate it. This includes reviewing system configurations, assessing potential exposure, and prioritizing patching or updates. Security teams should monitor for signs of Denial of Service (DoS) attacks and ensure incident response plans are in place. Operators and platform administrators should verify system patch levels and review compensating controls for exposed systems.

Technical summary

The vulnerability is caused by a NULL pointer dereference in the CDR processing path of free5gc v4.0.1. An attacker can cause a Denial of Service (DoS) by supplying a crafted payload. This issue has a HIGH CVSS score of 7.5, indicating a significant threat. The vulnerability affects the free5gc v4.0.1 version, and attackers can exploit it to cause service disruptions.

Defensive priority

CVE-2026-30072 has a HIGH CVSS score of 7.5, indicating a significant threat. Organizations using free5gc v4.0.1 should prioritize patching.

Recommended defensive actions

  • Apply patches or updates provided by the vendor to fix the NULL pointer dereference vulnerability
  • Restrict access to the CDR processing path to prevent crafted payloads from being supplied
  • Monitor systems for signs of Denial of Service (DoS) attacks

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further investigation is needed to fully understand the impact and affected scope. Organizations should verify their exposure by reviewing system configurations, checking for affected product deployments, and assessing potential Denial of Service (DoS) risks. Defensive verification tasks include confirming system patch levels, monitoring for suspicious activity, and ensuring incident response plans are in place.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-30072 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-30072

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-30072 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-30072

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.