CVE-2026-55784 free5gc CVE debrief

Who should care

Defenders responsible for 5G core network security, particularly those managing AUSF components and subscriber authentication, should assess exposure and implement mitigations. They should prioritize verifying exposure of 5G core network AUSF components, especially those handling subscriber authentication, and implement rate limiting or throttling for authentication requests.

Why it matters

CVE-2026-55784 is a high-severity vulnerability in the free5GC AUSF component that can cause denial of authentication to subscribers. Defenders should prioritize verifying exposure and implementing mitigations.

• Denial of authentication to subscribers due to overwritten authentication contexts
• Potential for service disruption or degradation in 5G core networks
• Need for verification of affected versions and exposure to the SBI/N12 interface
• Priority for implementing rate limiting or throttling for authentication requests

Technical summary

The free5GC AUSF component stores per-subscriber authentication state in a global sync.Map named AUSFContext.UePool in internal/context/context.go, keyed only by SUPI. Every request handled by internal/sbi/processor/ue_authentication.go creates an AusfUeContext, and AddAusfUeContextToPool executes ausfContext.UePool.Store(ausfUeContext.Supi, ausfUeContext), unconditionally replacing the active context for that SUPI. An attacker with access to the AUSF SBI/N12 interface can send concurrent POST /nausf-auth/v1/ue-authentications requests for the same target SUPI, causing all attempts to share one logical authentication context URL while K_aut, XRES, and EapID are repeatedly overwritten. A valid EAP-AKA' response

Defensive priority

Defenders should prioritize verifying exposure of 5G core network AUSF components, especially those handling subscriber authentication.

Recommended defensive actions

• Verify exposure of 5G core network AUSF components to the SBI/N12 interface
• Assess the impact of concurrent authentication requests on AUSF context
• Implement rate limiting or throttling for authentication requests
• Monitor for suspicious authentication request patterns
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the free5GC AUSF component vulnerability. However, no fixed version is available as of this review. The vulnerability affects the AUSF component in free5GC version 1.4.4 and earlier. Defenders should verify exposure of 5G core network AUSF components, especially those handling subscriber authentication. The CVE Program record and NVD entry provide source-provided CVE metadata and official vulnerability assessment.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.