A memory leak vulnerability in the free5GC PCF component allows unauthenticated attackers to trigger a Denial of Service, resulting in a complete failure of 5G session establishment.

This is an uncontrolled resource consumption flaw (CWE-400) caused by an improper middleware registration within the Gin router. An unauthenticated attacker with network access to the PCF SBI interface can send repeated HTTP requests to the OAM endpoint, causing the handler chain to grow indefinitely and exhausting system memory.

The exploitation of this vulnerability leads to a total Denial of Service for the PCF, which prevents User Equipment (UE) from obtaining necessary access and session management policies. Given the CVSS score of 7.5, this high-severity flaw poses a significant operational risk to 5G mobile core network availability. Successful exploitation would result in service outages, preventing new session establishment and disrupting connectivity for mobile subscribers.

Immediate Action: Upgrade the free5GC PCF component to version 1.4.3 or later to incorporate the patch that corrects the middleware registration logic.

Proactive Monitoring: Monitor server memory utilization and HTTP request patterns targeting the OAM endpoint for anomalous spikes that may indicate an ongoing resource exhaustion attack.

Compensating Controls: Implement strict network access control lists (ACLs) to restrict access to the PCF SBI interface, ensuring that only authorized network functions can communicate with the OAM endpoint.

Public Exploit Available: Unknown.

The potential for a complete network service disruption makes this vulnerability a high priority for organizations deploying 5G mobile core infrastructure. Network administrators must verify their current deployment versions and apply the update to version 1.4.3 immediately to eliminate the risk of resource exhaustion and ensure continued service availability.