CVE-2026-30653
Published: 24 March 2026
Summary
CVE-2026-30653 is a high-severity Uncontrolled Resource Consumption (CWE-400) vulnerability in Free5Gc Free5Gc. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked in the top 43.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SC-6 (Resource Availability).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly implements denial-of-service protections to block remote unauthenticated attacks exploiting resource exhaustion in the AMF HandleAuthenticationFailure function.
Requires timely remediation of the specific flaw (CWE-400) in Free5GC AMF via patches from the documented GitHub issue, eliminating the DoS vulnerability.
Enforces resource availability controls to mitigate uncontrolled resource consumption triggered by repeated authentication failure handling.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE describes remote unauthenticated exploitation of AMF (HandleAuthenticationFailure) causing availability impact via CWE-400 resource exhaustion; directly maps to application/system exploitation for endpoint DoS.
NVD Description
An issue in Free5GC v.4.2.0 and before allows a remote attacker to cause a denial of service via the function HandleAuthenticationFailure of the component AMF
Deeper analysisAI
CVE-2026-30653 is a denial-of-service vulnerability in Free5GC versions 4.2.0 and prior. The flaw exists in the AMF component, specifically within the HandleAuthenticationFailure function, allowing a remote attacker to trigger the issue.
The vulnerability has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating network accessibility, low attack complexity, no required privileges or user interaction, unchanged scope, and high impact on availability with no effects on confidentiality or integrity. A remote, unauthenticated attacker can exploit this to cause a denial of service on affected systems.
Mitigation details are documented in the GitHub issue at https://github.com/free5gc/free5gc/issues/826. The vulnerability is associated with CWE-400 (Uncontrolled Resource Consumption) and NVD-CWE-noinfo.
Details
- CWE(s)