CVE-2026-32937
mediumpriority · track · 26EPSS 0.004 · 36 %ileEUUSEPSS · scored 2026-10-28
free5GC is an open source 5G core network. free5GC CHF prior to version 1.2.2 has an out-of-bounds slice access vulnerability in the CHF `nchf-convergedcharging` service. A valid authenticated request to PUT `/nchf-convergedcharging/v3/recharging/:ueId?ratingGroup=...` can trigger a server-side panic in `github.com/free5gc/chf/internal/sbi.(*Server).RechargePut(...)` due to an out-of-range slice access. In the reported runtime, Gin recovery converts the panic into HTTP 500, but the recharge path remains remotely panic-triggerable and can be abused repeatedly to degrade recharge functionality and flood logs. In deployments without equivalent recovery handling, this panic may cause more severe service disruption. free5GC CHF patches the issue. Some workarounds are available: Restrict access to the `nchf-convergedcharging` recharge endpoint to strictly trusted NF callers only; apply rate limiting or network ACLs in front of the CHF SBI interface to reduce repeated panic-trigger attempts; if the recharge API is not required, temporarily disable or block external reachability to this route; and/or ensure panic recovery, monitoring, and alerting are enabled.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 4.9–7.1
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (3)
Products and version ranges known to be affected.
advisories (2)
Vendor and ecosystem advisories describing this.
- GHSA-6g43-577r-wf4xOut-of-Bounds Slice Access in free5GC CHF Leading to DoS2026-03-18ghsa · osvUS
### Impact This is an out-of-bounds slice access vulnerability in the CHF `nchf-convergedcharging` service. A valid authenticated request to PUT `/nchf-convergedcharging/v3/recharging/:ueId?ratingGroup=...` can trigger a server-side panic in `github.com/free5gc/chf/internal/sbi.(*Server).RechargePut(...)` due to an out-of-range slice access. In the reported runtime, Gin recovery converts the panic into HTTP 500, but the recharge path remains remotely panic-triggerable and can be abused repeatedly to degrade recharge functionality and flood logs. In deployments without equivalent recovery handling, this panic may cause more severe service disruption. ### Patches https://github.com/free5gc/chf/pull/61 ### Workarounds - Restrict access to the `nchf-convergedcharging` recharge endpoint to strictly trusted NF callers only. - Apply rate limiting or network ACLs in front of the CHF SBI interface to reduce repeated panic-trigger attempts. - If the recharge API is not required, temporarily disable or block external reachability to this route. - Ensure panic recovery, monitoring, and alerting are enabled.
- GO-2026-4750Out-of-Bounds Slice Access in free5GC CHF Leading to DoS in github.com/free5gc/chf2026-03-23vendor · osvUS
Out-of-Bounds Slice Access in free5GC CHF Leading to DoS in github.com/free5gc/chf
also known as (5)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (13)
External citations — patches, advisories, analysis.
- https://github.com/free5gc/chf/commit/55af766f321a00afa978e806548c96f8a7d2433ecnnvd
- https://github.com/free5gc/chf/pull/61cnnvd
- https://github.com/free5gc/chf/releasesPatchcnnvd
- https://github.com/free5gc/free5gc/issues/864cnnvd
- https://github.com/free5gc/free5gc/security/advisories/GHSA-6g43-577r-wf4xcnnvd
- https://github.com/free5gc/chf/commit/55af766f321a00afa978e806548c96f8a7d2433eenisa_euvd
- https://github.com/free5gc/chf/pull/61enisa_euvd
- https://github.com/free5gc/free5gc/issues/864enisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan