A critical vulnerability in the free5gc CreateUEContextProcedure function allows unauthenticated attackers to crash the service, resulting in a complete Denial of Service.

This vulnerability is a Denial of Service flaw located in the CreateUEContextProcedure function, specifically within the /v1/ue-contexts/{supi} endpoint. An unauthenticated attacker can exploit this by sending a specially crafted PUT request to the affected service.

The ability for an unauthenticated remote attacker to force a service outage poses a significant risk to the availability of core network infrastructure. Given the CVSS score of 7.5, this high-severity vulnerability could lead to critical system downtime, disrupting communication services and requiring manual intervention to restore operations.

Immediate Action: Monitor vendor communication channels for the release of a security patch addressing this endpoint flaw and apply it as soon as it becomes available.

Proactive Monitoring: Review access logs for the /v1/ue-contexts/ endpoint to identify anomalous PUT requests or repeated requests from unknown IP addresses that may precede a service crash.

Compensating Controls: Deploy Web Application Firewall (WAF) or API gateway rules to sanitize and validate incoming PUT requests to the /v1/ue-contexts/{supi} path, dropping malformed payloads.

Public Exploit Available: No confirmed public exploit (exploit_available: false).

Given the high impact on service availability, administrators should treat this vulnerability with urgency. If an immediate patch is not currently available, implement strict ingress filtering and rate limiting on the vulnerable API endpoint to prevent unauthorized actors from triggering the crash condition.