{"id":"CVE-2026-106805","kind":"vulnerability","aliases":["CVE-2026-106805"],"related":[],"title":"Free5GC: failed PFCP session setup leaks UE IP addresses, enabling denial of service","description":"A resource exhaustion issue exists in Free5GC v4.2.3 during PFCP Session Establishment failure handling. When the SMF does not receive a PFCP Session Establishment Response from the UPF, allocated UE IP address resources are not properly released. Repeated failed session establishment attempts can therefore exhaust the UE IP address pool, preventing new UEs from establishing PDU sessions and resulting in denial of service.","summary":"Free5GC v4.2.3's SMF does not release allocated UE IP addresses when it gets no PFCP Session Establishment Response from the UPF. Repeated failed session attempts can exhaust the UE IP pool, so new devices cannot open PDU sessions.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["5g-core","free5gc","runtime","smf","telecom","upf"],"not_affected_if":["no-upf-path","other-versions"],"how_to_check":"- Confirm the Free5GC version with `free5gc --version` or the build tag on the SMF image, and check whether it is `v4.2.3`.\n- Look at the SMF's UE IP pool usage and logs for repeated PFCP session establishment failures toward the UPF.","fix":null,"status":"open","published_at":"2026-11-02T17:17:33+00:00","first_seen_at":"2026-11-02T17:24:12+00:00","triaged_at":"2026-11-02T17:26:25+00:00","updated_at":"2026-11-02T17:26:25+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-11-02T17:26:25Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Free5GC: failed PFCP session setup leaks UE IP addresses, enabling denial of service","impact":"medium","summary":"Free5GC v4.2.3's SMF does not release allocated UE IP addresses when it gets no PFCP Session Establishment Response from the UPF. Repeated failed session attempts can exhaust the UE IP pool, so new devices cannot open PDU sessions.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["free5gc","5g-core","smf","upf","telecom"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"UE IP pool exhausted, new PDU sessions denied, service outage","analyst_note":"Check the NVD entry and the Free5GC project for a fixed version, severity score and whether an attacker must reach the PFCP interface or only cause UPF response loss.","how_to_check":"- Confirm the Free5GC version with `free5gc --version` or the build tag on the SMF image, and check whether it is `v4.2.3`.\n- Look at the SMF's UE IP pool usage and logs for repeated PFCP session establishment failures toward the UPF.","plain_action":"","needs_analyst":true,"not_affected_if":["other-versions","no-upf-path"],"who_is_affected":"Operators running Free5GC v4.2.3 as a 5G core, where the SMF talks to a UPF over PFCP and assigns UE IP addresses. Deployments on other versions, or without a UPF path that can drop Session Establishment Responses, are not described as affected by the sources.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000719,"input_tokens":4162,"output_tokens":605,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-106805':16A,19A '-2026':15A,18A '5g':21B '5g-core':20B 'address':9A,38B,98C,115C 'alloc':35B,95C 'attempt':53B,108C 'cannot':63B 'core':22B 'cve':14A,17A 'denial':11A,127C 'devic':62B 'enabl':10A 'establish':45B,78C,90C,107C,121C 'exhaust':55B,69C,111C 'exist':71C 'fail':2A,51B,105C 'failur':79C 'free5gc':1A,23B,28B,73C 'get':41B 'handl':80C 'ip':8A,37B,58B,97C,114C 'issu':70C 'leak':6A 'new':61B,118C 'open':64B 'pdu':65B,122C 'pfcp':3A,43B,76C,88C 'pool':59B,116C 'prevent':117C 'proper':102C 'receiv':86C 'releas':34B,103C 'repeat':50B,104C 'resourc':68C,99C 'respons':46B,91C 'result':125C 'runtim':24B 'servic':13A,129C 'session':4A,44B,52B,66B,77C,89C,106C,123C 'setup':5A 'smf':25B,31B,83C 'telecom':26B 'therefor':110C 'ue':7A,36B,57B,96C,113C,119C 'upf':27B,49B,94C 'v4.2.3':29B,74C","nicknames":[],"mitigations":[],"who_affected":"Operators running Free5GC v4.2.3 as a 5G core, where the SMF talks to a UPF over PFCP and assigns UE IP addresses. Deployments on other versions, or without a UPF path that can drop Session Establishment Responses, are not described as affected by the sources.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["5gcore","free5gc","runtime","smf","telecom","unknown","upf"],"first_public_at":"2026-11-02T17:17:33+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-106805","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106805","severity":null,"published_at":"2026-11-02T17:17:33+00:00","modified_at":"2026-11-02T17:17:33+00:00","first_seen_at":"2026-11-02T17:24:12+00:00","fetched_at":"2026-11-02T17:24:12+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}