CVE-2026-53551
Received Received - Intake

AUSF Authentication Failure via Null Byte Injection in free5GC

Publication date: 2026-07-31

Last updated on: 2026-07-31

Assigner: GitHub, Inc.

Description
free5GC is an open-source implementation of the 5G core network. Prior to 1.4.5, the free5GC AUSF (Authentication Server Function) does not validate the supiOrSuci field in UE authentication requests. Null bytes (\x00) and other control characters pass through JSON parsing unchanged and are forwarded to the UDM in an unescaped URL path. This causes Go's net/url.Parse() to fail, returning HTTP 500 "System failure" and leaking internal stack traces. An unauthenticated attacker can trigger this at scale causing denial of service for all subscribers attempting authentication through the affected AUSF. This vulnerability is fixed in 1.4.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-31
Last Modified
2026-07-31
Generated
2026-08-01
AI Q&A
2026-07-31
EPSS Evaluated
N/A
NVD
CVE-2026-53551
EUVD
EUVD-2026-51628

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
free5gc ausf to 1.4.5 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The vulnerability in free5GC's AUSF (Authentication Server Function) versions before 1.4.5 allows unauthenticated attackers to send UE authentication requests with malicious supiOrSuci fields containing null bytes or control characters. These pass through JSON parsing unchanged and reach the UDM as unescaped URL paths. This causes Go's net/url.Parse() to fail, returning HTTP 500 errors with internal stack traces, effectively crashing the service and denying authentication to all subscribers.

Detection Guidance

Detecting this vulnerability requires monitoring for HTTP 500 errors from the AUSF service, especially when malformed supiOrSuci fields are sent. Check AUSF logs for stack traces or errors related to URL parsing failures. Inspect network traffic for repeated requests with null bytes or control characters in authentication payloads.

Impact Analysis

If you use free5GC versions before 1.4.5, an attacker could exploit this to crash your AUSF service, preventing all subscribers from authenticating. This would disrupt 5G network access for users relying on your infrastructure, causing widespread service outages and potential loss of connectivity.

Compliance Impact

This vulnerability could lead to service disruptions, which may violate availability requirements in GDPR (Article 32) and HIPAA (Security Rule). Exposure of internal stack traces in error responses could also risk information disclosure, potentially breaching confidentiality obligations under these regulations.

Mitigation Strategies

Upgrade free5GC AUSF to version 1.4.5 or later to address the vulnerability. If immediate upgrade is not possible, restrict access to the AUSF service to trusted networks only and monitor for unusual authentication requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-53551. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart