CVE-2026-30068: Input Validation
Improper input validation in the HandleUpdate function (/sbi/parameterprovision.go) of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need to trigger the denial of service?
The available information only states that exploitation uses crafted input. It does not specify the required access level, network exposure, or authentication requirements.
Is a default free5gc deployment affected?
The data identifies free5gc v4.0.1 but does not state whether the vulnerable HandleUpdate path is enabled or reachable in a default deployment.
What mitigation is available if updating is not immediately possible?
No workaround or configuration-based mitigation is provided. Reducing exposure of interfaces that can deliver input to the affected HandleUpdate function may help, but the available data does not identify those interfaces.
How can I determine whether my environment is affected?
Verify whether you are running free5gc v4.0.1. The available information does not provide detection indicators, logs, or a proof-of-concept input pattern.