CVE-2026-1683
Published: 30 January 2026
Summary
CVE-2026-1683 is a medium-severity Improper Resource Shutdown or Release (CWE-404) vulnerability in Free5Gc Free5Gc. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 12.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Threat & Defense at a Glance
Threat & Defense Details
Likely Mitigating ControlsAI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Contingency plan updates incorporate proper resource shutdown and release steps, preventing attackers from leveraging incomplete cleanup during recovery scenarios.
Mandates explicit shutdown of the network connection at session conclusion, directly addressing improper resource release.
Requires proper shutdown/release procedures that include overwriting or isolating data to block unintended transfer via reused system objects.
Procedures can mandate orderly shutdown or release of resources when failures occur, preventing improper resource handling after a fault.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE directly describes a remotely exploitable flaw in a network service that crashes the target process (SMF/PFCP handler), matching Application or System Exploitation for Endpoint DoS.
NVD Description
A vulnerability has been found in Free5GC SMF up to 4.1.0. Affected by this vulnerability is the function HandlePfcpSessionReportRequest of the file internal/pfcp/handler/handler.go of the component PFCP. The manipulation leads to denial of service. Remote exploitation of the attack is…
more
possible. The exploit has been disclosed to the public and may be used. To fix this issue, it is recommended to deploy a patch.
Deeper analysisAI
CVE-2026-1683 is a denial-of-service vulnerability affecting Free5GC SMF versions up to 4.1.0. The issue resides in the HandlePfcpSessionReportRequest function within the file internal/pfcp/handler/handler.go of the PFCP component. Manipulation of this function can trigger a denial of service, as classified under CWE-404 (Improper Resource Shutdown or Release). The vulnerability carries a CVSS v3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), indicating medium severity with low impact on availability but no effects on confidentiality or integrity.
Any remote attacker can exploit this vulnerability without authentication or user interaction, given its network accessibility and low complexity. Successful exploitation leads to a denial of service on the affected SMF instance, potentially disrupting PFCP session reporting and related 5G core network functions.
Advisories recommend deploying a patch to mitigate the issue, with a fix available via GitHub pull request #188 in the free5gc/smf repository. Details and discussion are documented in free5gc/free5gc GitHub issue #804, including exploit disclosure to the public.
The exploit has been publicly disclosed, increasing the risk of active exploitation against unpatched Free5GC SMF deployments.
Details
- CWE(s)