CVE-2026-75439 Free5GC CVE debrief

Who should care

Defenders responsible for Free5GC deployments, particularly those using UPF components, should assess exposure and prioritize verification of potential denial-of-service attacks. Defenders should prioritize verifying exposure of UPF components in Free5GC v4.2.2 deployments and assessing the impact of potential denial-of-service attacks. Security teams and vulnerability management teams should review the supplied official advisory or CVE record to validate

Why it matters

CVE-2026-75439 is a high-severity denial-of-service vulnerability in Free5GC v4.2.2 via the UPF component. Defenders should prioritize verifying exposure and assessing potential impact.

• Denial-of-service attacks on UPF components may impact network availability
• Verification of Free5GC v4.2.2 deployments is necessary to determine exposure
• Remediation or mitigation strategies from Free5GC may be necessary to prevent exploitation

Technical summary

A denial-of-service vulnerability exists in Free5GC v4.2.2 via the UPF component. An attacker can exploit this vulnerability to cause a denial-of-service condition. The vulnerability affects Free5GC deployments, particularly those using UPF components. Verification of Free5GC v4.2.2 deployments is necessary to determine exposure. Remediation or mitigation strategies from Free5GC may be necessary to prevent exploitation. The CVE record and NVD entry indicate a denial-of-service vulnerability in Free5GC v4.2.2 via the UPF component.

Defensive priority

Defenders should prioritize verifying exposure of UPF components in Free5GC v4.2.2 deployments and assessing the impact of potential denial-of-service attacks.

Recommended defensive actions

• Verify exposure of UPF components in Free5GC v4.2.2 deployments
• Assess the impact of potential denial-of-service attacks on UPF components
• Monitor for updates from Free5GC on remediation or mitigation strategies
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry indicate a denial-of-service vulnerability in Free5GC v4.2.2 via the UPF component. Multiple sources, including a GitHub issue and pull request, reference the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.