free5GC AUSF uses non-constant-time authentication comparisons and logs XRES* in 5G-AKA

Summary The AUSF component of free5GC compares authentication response values with normal Go equality helpers instead of constant-time cryptographic comparison functions. Two authentication flows are affected in internal/sbi/processor/ueauthentication.go: 1. 5G-AKA confirmation compares RES and...

GHSA-FP46-6VFW-GC9C free5GC AUSF uses non-constant-time authentication comparisons and logs XRES* in 5G-AKA

Summary The AUSF component of free5GC compares authentication response values with normal Go equality helpers instead of constant-time cryptographic comparison functions. Two authentication flows are affected in internal/sbi/processor/ueauthentication.go: 1. 5G-AKA confirmation compares RES and...

CVE-2026-55785 free5GC AUSF uses non-constant-time authentication comparisons and logs XRES* in 5G-AKA

free5GC is an open-source implementation of the 5G core network. Prior to 1.4.5, the AUSF component performs cryptographic authentication comparisons in internal/sbi/processor/ueauthentication.go with ordinary equality helpers. Auth5gAkaComfirmRequestProcedure compares RES and XRES with...

EUVD-2026-68017

free5GC is an open-source implementation of the 5G core network. Prior to 1.4.5, the AUSF component performs cryptographic authentication comparisons in internal/sbi/processor/ueauthentication.go with ordinary equality helpers. Auth5gAkaComfirmRequestProcedure compares RES and XRES with...

free5GC AUSF authentication contexts can be overwritten by concurrent requests for the same SUPI

Summary The AUSF component of free5GC stores per-subscriber authentication state in a global sync.Map keyed only by SUPI. Every incoming authentication request creates a new AusfUeContext and stores it under that SUPI key without checking whether an authentication procedure is already in progress...

GHSA-334Q-H5G3-FPXV free5GC AUSF authentication contexts can be overwritten by concurrent requests for the same SUPI

Summary The AUSF component of free5GC stores per-subscriber authentication state in a global sync.Map keyed only by SUPI. Every incoming authentication request creates a new AusfUeContext and stores it under that SUPI key without checking whether an authentication procedure is already in progress...

CVE-2026-33063

free5GC is an open source 5G core network. free5GC AUSF prior to version 1.4.2 has is an Improper Null Check vulnerability leading to Denial of Service. All deployments of free5GC v4.0.1 using the AUSF UE authentication service /nausf-auth/v1/ue-authentications endpoint are affected. A remote...

CVE-2026-33063

CVE-2026-33063 affects free5GC AUSF prior to 1.4.2. The vulnerability is an improper nil check in GetSupiFromSuciSupiMap, which can panic when SuciSupiMap is nil, causing the AUSF authentication service to crash and deny service for deployments using the UE authentication endpoint /nausf-auth/v1/...

CVE-2026-33063 free5GC AUSF UE Authentication Panic on Nil SuciSupiMap Interface Conversion

free5GC is an open source 5G core network. free5GC AUSF prior to version 1.4.2 has is an Improper Null Check vulnerability leading to Denial of Service. All deployments of free5GC v4.0.1 using the AUSF UE authentication service /nausf-auth/v1/ue-authentications endpoint are affected. A remote...