What’s Vulnerable › Vulnerabilities

CVE-2026-1683: Free5GC SMF PFCP handler.go HandlePfcpSessionReportRequest denial of service

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-01-30 · updated 2026-06-17
• Weakness: CWE-404

Description

A vulnerability has been found in Free5GC SMF up to 4.1.0. Affected by this vulnerability is the function HandlePfcpSessionReportRequest of the file internal/pfcp/handler/handler.go of the component PFCP. The manipulation leads to denial of service. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. To fix this issue, it is recommended to deploy a patch.

Affected products

• free5gc: through 4.1.0

References

• https://github.com/free5gc/free5gc/issues/804
• https://github.com/free5gc/free5gc/issues/804#issue-3816086696
• https://github.com/free5gc/smf/
• https://github.com/free5gc/smf/pull/188
• https://vuldb.com/?ctiid.343476
• https://vuldb.com/?id.343476
• https://vuldb.com/?submit.739653
• https://vuldb.com/?submit.739654

Get alerted when CVE-2026-1683 or the next vulnerability affects your stack