CVE-2026-41135: 
NixOS vulnerability analysis and mitigation

CVE-2026-41135 is a memory leak vulnerability in the free5GC Policy Control Function (PCF) that allows any unauthenticated attacker with network access to the PCF SBI interface to cause uncontrolled memory growth, leading to Denial of Service. It affects free5GC PCF versions prior to 1.4.3 and free5GC versions up to and including 4.2.1. The vulnerability was published on April 21, 2026, with a patch released in PCF version 1.4.3. It carries a CVSS v3.1 base score of 7.5 (High) (Github Advisory).

The root cause is classified as CWE-400 (Uncontrolled Resource Consumption). The vulnerable code resides in free5gc/pcf/internal/sbi/api_oam.go within the setCorsHeader() function, which is called by HTTPOAMGetAmPolicy() on every incoming HTTP GET request to /npcf-oam/v1/am-policy/:supi. The function incorrectly calls s.router.Use() inside the HTTP handler rather than during server initialization — in the Gin framework, router.Use() appends (not replaces) a new CORS middleware instance to the router's internal handler chain on every invocation, so after N requests, N middleware instances are queued before the actual handler. Because s.router holds a permanent reference to this ever-growing slice, the Go garbage collector cannot reclaim the memory, resulting in progressive heap exhaustion. A secondary CORS misconfiguration (AllowAllOrigins: true combined with AllowCredentials: true) is also present but is of lesser severity (Github Advisory, free5gc Advisory).

Successful exploitation causes progressive memory exhaustion of the PCF process, ultimately triggering an OOM kill and complete Denial of Service. Because the PCF is responsible for delivering Access and Mobility (AM) policies to the AMF and Session Management (SM) policies to the SMF, a crashed PCF prevents new UE registrations, new PDU session establishment, and policy updates for existing sessions — effectively causing a complete loss of 5G service for all subscribers served by the affected PCF instance. There is no confidentiality or integrity impact; the attack is purely an availability-class threat (Github Advisory).

A proof-of-concept exploit is publicly documented in the official security advisory, consisting of a simple bash loop using curl that requires no authentication or special privileges — only network reachability to the PCF SBI interface. In the default free5GC Docker deployment, all core network function containers share the same Docker network, meaning any compromised NF container can trigger the vulnerability. There is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.041–0.048%, indicating low near-term exploitation probability. The vulnerability is not listed in the CISA KEV catalog (Github Advisory, Feedly).

1. Reconnaissance: Identify a free5GC deployment running PCF version prior to 1.4.3. Confirm network reachability to the PCF SBI interface (default port 80) from within the 5G core Docker network or any network-adjacent position.
2. Identify the vulnerable endpoint: Target the OAM endpoint GET /npcf-oam/v1/am-policy/:supi, where :supi can be any IMSI-format string (e.g., imsi-222771234567890). No authentication token is required when OAuth2 is disabled (the default).
3. Record memory baseline: Run docker stats --no-stream | grep pcf to note the PCF container's current memory usage (e.g., ~24.86 MiB).
4. Launch HTTP flood: Execute a concurrent request loop from any reachable host:

for i in $(seq 1 5000); do
  curl -s http://<PCF_IP>/npcf-oam/v1/am-policy/imsi-222771234567890 > /dev/null &
  [ $((i % 100)) -eq 0 ] && wait && echo "[*] $i req sent"
done
wait

5. Monitor memory growth: Use watch -n 2 "docker stats --no-stream | grep pcf" to observe memory increasing with each batch (~21 MiB after 5,000 requests, ~33 MiB after 10,000 requests). Memory does not return to baseline between batches.
6. Achieve DoS: Continue sending requests until the PCF process is OOM-killed by the kernel, at which point all UE registrations and PDU session establishments fail (Github Advisory).

• Network: High volume of HTTP GET requests to /npcf-oam/v1/am-policy/<IMSI> from a single source IP or container within the 5G core network; requests arriving in rapid succession with no inter-request delay.
• Process/Container: Steadily increasing memory consumption of the PCF container as observed via docker stats; memory does not decrease between request bursts; eventual OOM kill event for the PCF process.
• Logs: PCF access logs showing thousands of repeated GET requests to the OAM endpoint from the same source; Gin framework logs may show abnormal handler chain depth or latency increases as middleware accumulates.
• System: Kernel OOM killer log entries (dmesg or /var/log/syslog) referencing the PCF process being killed; downstream AMF/SMF errors indicating PCF policy retrieval failures (Github Advisory).

The primary remediation is to upgrade the free5GC PCF module to version 1.4.3 or later, which moves the router.Use(cors.New(...)) call to the server initialization function so it executes only once at startup. As interim workarounds, operators should implement network-level rate limiting on the OAM endpoint to reduce request frequency, and apply network segmentation to restrict access to the PCF SBI interface to only authorized 5G core NF components. The fix commit is available at free5gc/pcf@599803b (Github Advisory, Patch Commit).

The vulnerability was reported by researcher Giancannella and published by the free5GC maintainer Alonza0314 via GitHub Security Advisories on April 21, 2026. The advisory was picked up by automated vulnerability tracking services including CVEFeed, VulDB, INCIBE-CERT, and GitLab Advisory Database shortly after disclosure. No significant independent researcher commentary or broader media coverage has been identified beyond standard vulnerability aggregator entries (Github Advisory).