Resource Exhaustion in Free5GC Due to PFCP Session Failure

Executive Summary

CVE-2026-106805 is a resource exhaustion vulnerability in Free5GC v4.2.3's Session Management Function (SMF). When the SMF sends a PFCP Session Establishment Request to the UPF and fails to receive a response, it repeatedly retransmits requests without releasing allocated UE IP address resources. This causes the IP address pool to be exhausted over time, preventing new UEs from establishing PDU sessions and resulting in a denial of service.

Useful 0 Not Useful 0

Detection Guidance

Monitor for repeated PFCP Session Establishment Request retransmissions from the SMF to the UPF without corresponding responses. Check for gradual depletion of UE IP address pools in Free5GC logs. Use network traffic analysis tools like tcpdump or Wireshark to capture PFCP messages on the N4 interface and look for failed session establishments.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause a denial of service by preventing new UEs from connecting to the network. If an attacker repeatedly triggers failed session establishments, the IP address pool may be depleted, blocking legitimate users from establishing PDU sessions. This disrupts network services and could lead to service outages.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily causes a denial-of-service condition by exhausting UE IP address pools, which could disrupt network services. While not directly violating GDPR or HIPAA, such disruptions may impact data processing operations subject to these regulations. GDPR requires ensuring availability of personal data processing systems, and HIPAA mandates reliable access to protected health information systems. A DoS condition could hinder compliance by preventing timely access to required data.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Free5GC to a version that includes the PFCP refactor (e.g., after free5gc/smf#236). Implement rate limiting on PFCP Session Establishment Requests. Monitor IP pool usage and set alerts for abnormal depletion rates. Ensure proper logging and alerting for failed PFCP session establishments.

Useful 0 Not Useful 0