Denial of Service in free5gc NssaiAvailabilitySubscriptionCreate

Executive Summary

CVE-2026-30073 is a Denial of Service (DoS) vulnerability in free5GC v4.0.1 affecting the NssaiAvailabilitySubscriptionCreate component. It occurs when a crafted POST request triggers a nil pointer dereference in the NSSF service, causing it to crash. The issue stems from unsafe handling of a shared global configuration object without proper initialization or synchronization.

Useful 0 Not Useful 0

Detection Guidance

Monitor the NSSF service logs for crashes or nil pointer panics after receiving POST requests to /nnssf-nssaiavailability/v1/nssai-availability/subscriptions. Check for service restarts or error messages indicating a nil pointer dereference in the NssaiAvailabilitySubscriptionCreate handler.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can disrupt the NSSF service, leading to service outages or degraded performance for network slice selection functions. Attackers could exploit it by sending a single malicious POST request to crash the system, potentially affecting network operations dependent on free5GC.

Useful 0 Not Useful 0

Mitigation Strategies

Apply patches or updates from the free5GC project that address the nil pointer dereference in the NssaiAvailabilitySubscriptionCreate handler. Implement input validation for POST requests to the vulnerable endpoint and ensure proper initialization of shared global configuration objects before modification.

Useful 0 Not Useful 0