Denial of Service in free5gc RechargePut Function

Executive Summary

CVE-2026-30071 is a Denial of Service (DoS) vulnerability in free5gc v4.0.1's Converged Charging Function (CHF). The RechargePut function crashes when the rechargingInfo path parameter lacks an underscore. It splits the parameter by '_' and tries to access the second element without checking if the split result has enough parts, causing a runtime panic and service instability.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for crashes or instability in the free5gc Converged Charging Function (CHF) service. Check logs for runtime panics or 'index out of range' errors related to the RechargePut function. Test by sending malformed requests with the rechargingInfo parameter missing an underscore to see if the service crashes.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause the free5gc service to crash or become unstable, leading to service disruptions. Attackers could exploit it by sending crafted inputs to trigger a DoS condition, affecting the availability of the charging function in a 5G network.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability causes a Denial of Service (DoS) by crashing the RechargePut function in free5gc's Converged Charging Function (CHF) due to improper input validation. This could disrupt critical telecom services, potentially leading to unauthorized data access or service unavailability, which may violate compliance requirements for availability and integrity in standards like GDPR and HIPAA.

Useful 0 Not Useful 0

Mitigation Strategies

Apply a patch or update to free5gc that fixes the RechargePut function to validate the rechargingInfo format before processing. If a patch is unavailable, implement input validation in the CHF service to reject requests where rechargingInfo lacks an underscore. Temporarily restrict access to the RechargePut endpoint if possible.

Useful 0 Not Useful 0