---
id: "CVE-2026-106805"
kind: "vulnerability"
aliases: ["CVE-2026-106805"]
title: "Free5GC: failed PFCP session setup leaks UE IP addresses, enabling denial of service"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["5g-core", "free5gc", "runtime", "smf", "telecom", "upf"]
not_affected_if: ["no-upf-path", "other-versions"]
published_at: "2026-11-02T17:17:33+00:00"
first_seen_at: "2026-11-02T17:24:12+00:00"
updated_at: "2026-11-02T17:26:25+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106805", "first_seen_at": "2026-11-02T17:24:12+00:00"}]
---

# Free5GC: failed PFCP session setup leaks UE IP addresses, enabling denial of service

Free5GC v4.2.3's SMF does not release allocated UE IP addresses when it gets no PFCP Session Establishment Response from the UPF. Repeated failed session attempts can exhaust the UE IP pool, so new devices cannot open PDU sessions.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm the Free5GC version with `free5gc --version` or the build tag on the SMF image, and check whether it is `v4.2.3`.
- Look at the SMF's UE IP pool usage and logs for repeated PFCP session establishment failures toward the UPF.

## Timeline

- 2026-11-02T17:24:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-106805

## From the sources

A resource exhaustion issue exists in Free5GC v4.2.3 during PFCP Session Establishment failure handling. When the SMF does not receive a PFCP Session Establishment Response from the UPF, allocated UE IP address resources are not properly released. Repeated failed session establishment attempts can therefore exhaust the UE IP address pool, preventing new UEs from establishing PDU sessions and resulting in denial of service.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_