Detections
Analytics

SCA: security update for github.com/free5gc/chf (GHSA-6g43-577r-wf4x)

high Tenable Self-Hosted Container Security Plugin ID 438928

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - free5GC is an open source 5G core network. free5GC CHF prior to version 1.2.2 has an out-of-bounds slice
 access vulnerability in the CHF `nchf-convergedcharging` service. A valid authenticated request to PUT
 `/nchf-convergedcharging/v3/recharging/:ueId?ratingGroup=...` can trigger a server-side panic in
 `github.com/free5gc/chf/internal/sbi.(*Server).RechargePut(...)` due to an out-of-range slice access. In
 the reported runtime, Gin recovery converts the panic into HTTP 500, but the recharge path remains
 remotely panic-triggerable and can be abused repeatedly to degrade recharge functionality and flood logs.
 In deployments without equivalent recovery handling, this panic may cause more severe service disruption.
 free5GC CHF patches the issue. Some workarounds are available: Restrict access to the `nchf-
 convergedcharging` recharge endpoint to strictly trusted NF callers only; apply rate limiting or network
 ACLs in front of the CHF SBI interface to reduce repeated panic-trigger attempts; if the recharge API is
 not required, temporarily disable or block external reachability to this route; and/or ensure panic
 recovery, monitoring, and alerting are enabled. (CVE-2026-32937)

Solution

Update the github.com/free5gc/chf library and its related packages to version 1.2.2 or later.

See Also

https://github.com/advisories/GHSA-6g43-577r-wf4x

Plugin Details

Severity: High

ID: 438928

Version: Revision 1.11

Type: Local

Family: SCA Checks

Published: 3/18/2026

Updated: 7/6/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.73

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2026-32937

CVSS v3

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 5.7

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 7.1

Threat Score: 7.1

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 3/18/2026

Vulnerability Publication Date: 3/18/2026

Reference Information

CVE: CVE-2026-32937

cwe: CWE-129