CVE-2026-33063
Published: 20 March 2026
Summary
CVE-2026-33063 is a high-severity NULL Pointer Dereference (CWE-476) vulnerability in Free5Gc Free5Gc. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 33.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-11 (Error Handling).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the improper null check flaw in the GetSupiFromSuciSupiMap function by applying the vendor patch to prevent the panic and DoS.
Implements safeguards like rate limiting or traffic filtering to protect the AUSF /nausf-auth/v1/ue-authentications endpoint from remote crafted requests causing denial of service.
Ensures error handling for nil interface conversions does not compromise system availability by crashing the AUSF service on malformed authentication requests.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a remote unauthenticated flaw in a network-accessible 5G AUSF API endpoint; sending a crafted request triggers a nil interface conversion panic that crashes the service, directly enabling application exploitation for endpoint denial of service.
NVD Description
free5GC is an open source 5G core network. free5GC AUSF prior to version 1.4.2 has is an Improper Null Check vulnerability leading to Denial of Service. All deployments of free5GC v4.0.1 using the AUSF UE authentication service (`/nausf-auth/v1/ue-authentications` endpoint) are…
more
affected. A remote attacker can cause the AUSF service to panic and crash by sending a crafted UE authentication request that triggers a nil interface conversion in the `GetSupiFromSuciSupiMap` function. This results in complete denial of service for the AUSF authentication service. The `GetSupiFromSuciSupiMap` function attempts to perform an interface conversion from `interface{}` to `*context.SuciSupiMap` without checking if the underlying value is nil. When `SuciSupiMap` is nil, the code panics with "interface conversion: interface {} is nil, not *context.SuciSupiMap". free5GC AUSF version 1.4.2 patches the issue. There is no direct workaround at the application level. The recommendation is to apply the provided patch or restrict access to the AUSF API to trusted sources only.
Deeper analysisAI
CVE-2026-33063 is an Improper Null Check vulnerability (CWE-476) in the AUSF component of free5GC, an open-source 5G core network implementation. AUSF versions prior to 1.4.2 are affected, including all deployments of free5GC v4.0.1 that utilize the UE authentication service at the `/nausf-auth/v1/ue-authentications` endpoint. The flaw occurs in the `GetSupiFromSuciSupiMap` function, which attempts an interface conversion from `interface{}` to `*context.SuciSupiMap` without checking if the underlying `SuciSupiMap` value is nil, triggering a panic with the error "interface conversion: interface {} is nil, not *context.SuciSupiMap" and leading to denial of service.
A remote, unauthenticated attacker can exploit this vulnerability by sending a crafted UE authentication request to the affected endpoint, causing the AUSF service to panic and crash. This results in a complete denial of service for the AUSF authentication service, disrupting 5G core network authentication operations. The vulnerability carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), reflecting its high availability impact and ease of remote exploitation without privileges or user interaction.
free5GC AUSF version 1.4.2 patches the issue by addressing the nil check in the interface conversion. No direct application-level workaround exists, though restricting access to the AUSF API to trusted sources is recommended as a mitigation. Key resources include the patching commit (https://github.com/free5gc/ausf/commit/3b9ac4403c2756dc89a5ed3cdcefe688458588aa), pull request (https://github.com/free5gc/ausf/pull/52), issue discussion (https://github.com/free5gc/free5gc/issues/778), and GitHub security advisory (https://github.com/free5gc/free5gc/security/advisories/GHSA-4jrw-92fg-4jwx).
Details
- CWE(s)