Detections
Analytics

SCA: security update for github.com/free5gc/pcf (GHSA-wr8j-6chw-gm6p)

high Tenable Cloud Security Plugin ID 441590

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's PCF POST /npcf-
 smpolicycontrol/v1/sm-policies handler (HandleCreateSmPolicyRequest) panics with a nil-pointer dereference
 when a downstream OpenAPI consumer call (UDR lookup) returns 404 Not Found and the consumer wrapper
 returns err != nil together with a nil response struct. The handler logs the OpenAPI error and continues
 executing instead of returning, then dereferences the nil response struct on a subsequent line and panics.
 Gin recovery converts the panic into HTTP 500, so a single attacker-shaped POST returns 500 instead of a
 clean 4xx whenever the downstream lookup fails. The PCF process keeps running. The trigger is a single
 POST containing input that causes the downstream UDR lookup to fail (e.g. an unknown DNN). In 4.2.1 this
 endpoint is also reachable WITHOUT an Authorization header because the PCF Npcf_SMPolicyControl route
 group is mounted without inbound auth middleware. This vulnerability is fixed in 4.2.2. (CVE-2026-44316)

Solution

Update the github.com/free5gc/pcf library and its related packages to version 1.4.2 or later.

See Also

https://github.com/advisories/GHSA-wr8j-6chw-gm6p

Plugin Details

Severity: High

ID: 441590

Version: Revision 1.5

Type: Local

Family: SCA Checks

Published: 5/9/2026

Updated: 6/1/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 5

Percentile: 94.36

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.1

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2026-44316

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 5/8/2026

Vulnerability Publication Date: 5/8/2026

Reference Information

CVE: CVE-2026-44316