{"id":"CVE-2026-44325","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-44325","generatedAt":"2026-10-28T02:24:36.574Z","title":"The parsed *models.PlmnId is then assigned with reflect.Value.Set() to whichever field name the attacker put in the form body, which panics whenever the destination field's real type is incompatible (slice, different struct, primitive).","description":"free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's NRF root SBI endpoint POST /oauth2/token contains a parser-level type-confusion bug family. The handler in NFs/nrf/internal/sbi/api_accesstoken.go reflects over models.NrfAccessTokenAccessTokenReq, special-cases only plain string and NrfNfManagementNfType fields, and treats every other field as if it were a single models.PlmnId. The parsed *models.PlmnId is then assigned with reflect.Value.Set() to whichever field name the attacker put in the form body, which panics whenever the destination field's real type is incompatible (slice, different struct, primitive). Gin recovery converts each panic into HTTP 500, but the endpoint remains remotely panicable from a single unauthenticated form-encoded request and is repeatedly triggerable. This vulnerability is fixed in 4.2.2.","published":"2026-05-27T17:16:38.000Z","lastModified":"2026-10-14T20:10:00.000Z","status":"Analyzed","sourceIdentifier":"security-advisories@github.com","cvss":{"version":"3.1","score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"cwe":["CWE-20","CWE-755","CWE-843"],"affected":["free5gc/free5gc"],"epss":{"score":0.00394,"percentile":0.33312,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (0.39%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[],"references":[{"url":"https://github.com/free5gc/free5gc/issues/918","tags":["Exploit","Issue Tracking"],"source":"security-advisories@github.com"},{"url":"https://github.com/free5gc/free5gc/security/advisories/GHSA-f8qv-7x5w-qr48","tags":["Exploit","Vendor Advisory"],"source":"security-advisories@github.com"},{"url":"https://github.com/free5gc/nrf/commit/f7bc77daa7425506af7569f2e61c2a210f5a0423","tags":["Patch"],"source":"security-advisories@github.com"},{"url":"https://github.com/free5gc/nrf/pull/83","tags":["Issue Tracking","Patch"],"source":"security-advisories@github.com"},{"url":"https://github.com/free5gc/free5gc/security/advisories/GHSA-f8qv-7x5w-qr48","tags":["Exploit","Vendor Advisory"],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-44325","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}