CVE-2026-106805: Security vulnerability

Published Nov 2, 2026

Updated

A resource exhaustion issue exists in Free5GC v4.2.3 during PFCP Session Establishment failure handling. When the SMF does not receive a PFCP Session Establishment Response from the UPF, allocated UE IP address resources are not properly released. Repeated failed session establishment attempts can therefore exhaust the UE IP address pool, preventing new UEs from establishing PDU sessions and resulting in denial of service.

Event History

Nov 2, 2026

CVE Published

via NVD·05:17 PM

Data Sourced

via NVD·05:17 PM

Description

Frequently Asked Questions

What conditions are required for exploitation?

The SMF must attempt PFCP Session Establishment with a UPF and fail to receive a PFCP Session Establishment Response. Repeated failed establishment attempts are required to consume UE IP address resources.

What is the operational impact once the UE IP address pool is exhausted?

New UEs cannot establish PDU sessions, causing a denial of service. The issue affects UE IP address resources allocated during failed session establishment handling.

How can operators identify that they may be affected?

Look for repeated PFCP Session Establishment attempts for which the SMF does not receive a response from the UPF, together with UE IP address allocations that are not released. Exhaustion of the UE IP address pool and failures for new UEs to establish PDU sessions are indicators of impact.

CVE-2026-106805: Security vulnerability

Event History

Frequently Asked Questions

What conditions are required for exploitation?

What is the operational impact once the UE IP address pool is exhausted?

How can operators identify that they may be affected?

Company

Resources

Contact

Frequently Asked Questions

What conditions are required for exploitation?

What is the operational impact once the UE IP address pool is exhausted?

How can operators identify that they may be affected?