Live › vulnerability › CVE-2026-106805
Free5GC v4.2.3's SMF does not release allocated UE IP addresses when it gets no PFCP Session Establishment Response from the UPF. Repeated failed session attempts can exhaust the UE IP pool, so new devices cannot open PDU sessions.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 17:24 UTC. All times on this page are UTC.
Operators running Free5GC v4.2.3 as a 5G core, where the SMF talks to a UPF over PFCP and assigns UE IP addresses. Deployments on other versions, or without a UPF path that can drop Session Establishment Responses, are not described as affected by the sources.
No product ranges from the sources yet.
free5gc --version or the build tag on the SMF image, and check whether it is v4.2.3.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A resource exhaustion issue exists in Free5GC v4.2.3 during PFCP Session Establishment failure handling. When the SMF does not receive a PFCP Session Establishment Response from the UPF, allocated UE IP address resources are not properly released. Repeated failed session establishment attempts can therefore exhaust the UE IP address pool, preventing new UEs from establishing PDU sessions and resulting in denial of service.
This page as .md · .json · in your agent: get_signal("CVE-2026-106805")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.