CVE-2026-33062: 
vulnerability analysis and mitigation

CVE-2026-33062 is an Improper Input Validation vulnerability in the NRF (Network Repository Function) discovery service of free5GC, an open-source 5G core network implementation. The flaw resides in the EncodeGroupId function, which fails to validate the length of split data before accessing array indices, causing a Go runtime panic and complete denial of service when a crafted HTTP GET request with a malformed group-id-list or external-group-identity parameter is received. It affects free5GC versions prior to github.com/free5gc/nrf v1.4.2 (corresponding to free5GC v4.0.1 and earlier). The vulnerability was published on March 18, 2026, and carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 8.7 (High) (GitHub Advisory).

The root cause is CWE-20 (Improper Input Validation): the EncodeGroupId function in internal/context/dataconv.go splits the external-group-identity parameter on a delimiter and directly accesses indices [0], [1], and [2] without first verifying that the resulting slice contains enough elements (GitHub Advisory, free5gc Issue #777). When a remote attacker sends an HTTP GET request to the NRF discovery endpoint (/nnrf-disc/v1/nf-instances) with a malformed group-id-list or external-group-identity parameter containing fewer separator characters than expected, the Go runtime raises an "index out of range" panic, crashing the NRF service goroutine (free5gc Issue #777). No authentication is required; the attack is fully unauthenticated and exploitable over the network with low complexity. The fix, implemented in PR free5gc/nrf#80 (commit dac77d8), adds a ValidateGroupIdFormat() function with a regex pattern and changes buildFilter to return an error, propagating a 400 Bad Request response instead of panicking (free5gc PR #80).

Successful exploitation results in a complete denial of service for the NRF discovery service — the central service registry component of a 5G core network. Because the NRF is responsible for NF (Network Function) registration and discovery, crashing it disrupts the ability of all other 5G core network functions (AMF, SMF, UPF, etc.) to locate and communicate with each other, potentially taking down the entire 5G core deployment. There is no confidentiality or integrity impact; the sole consequence is high availability impact to the vulnerable system (GitHub Advisory).

A public proof-of-concept exploit exists as a concrete curl command documented in free5GC GitHub Issue #777, which demonstrates triggering the index-out-of-range panic with a malformed group-id-list parameter (free5gc Issue #777). The vulnerability requires no authentication, no user interaction, and no special privileges, making it trivially exploitable by any network-accessible attacker. The EPSS score is approximately 0.127% (0.088% per GitHub Advisory), indicating low but non-zero probability of exploitation in the wild within 30 days. There is no current evidence of active in-the-wild exploitation or threat actor attribution, and the vulnerability is not listed in the CISA KEV catalog (GitHub Advisory).

1. Reconnaissance: Identify internet-facing or network-accessible free5GC NRF instances running version v4.0.1 or earlier. The NRF SBI endpoint is typically exposed on a configured IP and port (e.g., http://127.0.0.10:8000 in default configurations).
2. Disable OAuth (if applicable): In test or misconfigured deployments, OAuth may be disabled in nrfcfg.yaml (oauth: false), removing the authentication barrier entirely.
3. Craft malformed request: Construct an HTTP GET request to /nnrf-disc/v1/nf-instances with a group-id-list parameter containing a value with insufficient dash-separated components (e.g., group-id-list=%5B%221%22%5D, which URL-decodes to ["1"]), or an external-group-identity parameter lacking the required prefix-mcc-mnc-localGroupId format.
4. Send the request: Execute the crafted request against the NRF endpoint:

curl -v "http://<NRF_IP>:<PORT>/nnrf-disc/v1/nf-instances?target-nf-type=NRF&requester-nf-type=NRF&group-id-list=%5B%221%22%5D"

5. Trigger panic: The EncodeGroupId function attempts to access split[0], split[1], split[2] on the undersized slice, causing a Go runtime panic (index out of range [2] with length 2).
6. Service crash: The NRF service crashes or returns HTTP 500, resulting in complete denial of service for the NRF discovery endpoint and disrupting all dependent 5G core NF communications (free5gc Issue #777).

• Logs: NRF log entries containing panic: runtime error: index out of range originating from github.com/free5gc/nrf/internal/context.EncodeGroupId or nf_discovery.go; log lines showing [ERRO][NRF][GIN] panic followed by a goroutine stack trace; HTTP 500 responses logged for GET /nnrf-disc/v1/nf-instances requests.
• Network: Unusual or repeated HTTP GET requests to /nnrf-disc/v1/nf-instances containing group-id-list or external-group-identity parameters with malformed values (e.g., single-element arrays like ["1"] or values lacking the expected prefix-mcc-mnc-localGroupId dash-separated format); requests originating from unexpected source IPs.
• Process: Unexpected NRF process restarts or crashes; Go runtime panic output in the NRF service's stderr or log files referencing dataconv.go and EncodeGroupId (free5gc Issue #777).

Upgrade the github.com/free5gc/nrf Go module to version 1.4.2 or later, which includes the fix from PR free5gc/nrf#80 (commit dac77d8f8f2e0f041c5634fb3c685dcb9734b872) that adds ValidateGroupIdFormat() input validation before calling EncodeGroupId (GitHub Advisory, free5gc PR #80). There is no direct application-level workaround; as a temporary measure, restrict network access to the NRF SBI API to trusted internal sources only using firewall rules or network segmentation to prevent unauthenticated external access (GitHub Advisory).