CVE-2026-53551: Improper Input Validation in free5GC Authentication Server Function (AUSF)

The Authentication Server Function (AUSF) of free5GC, an open-source 5G core network implementation, is vulnerable to improper input validation in its Service Based Interface (SBI) endpoint. Prior to version 1.4.5 of the AUSF component, the service accepts user-supplied string fields without verification or sanitization.

This lack of validation exposes a critical attack surface on the HTTP/2 API endpoint /nausf-auth/v1/ue-authentications. An unauthenticated remote attacker can supply malformed requests targeting the subscription identifiers, which propagates downstream to internal network functions.

The vulnerability manifests when the AUSF processes the supiOrSuci key in the request payload. By sending control characters inside this field, the attacker forces an unhandled exception inside the Go standard library, culminating in service unavailability.

The root cause of this vulnerability lies in the improper handling of string variables inside the UeAuthPostRequestProcedure function in internal/sbi/processor/ue_authentication.go. The Go programming language standard library encoding/json decodes incoming JSON payloads without rejecting or escaping embedded control characters, including null bytes (\x00).

When a client submits an authentication request containing raw null bytes in the supiOrSuci parameter, the JSON unmarshaler deserializes the malformed string. The AUSF then uses this parameter to construct an outbound HTTP request aimed at the Unified Data Management (UDM) network function.

The dynamic URL string generation process appends the unvalidated supiOrSuci value directly into the URL path segment. When the constructed URL is passed to Go's net/url.Parse() function for validation prior to execution, the parsing routine detects RFC 3986 compliance violations.

Because the URL contains control characters, the Parse() function returns a syntax error. The AUSF fails to handle this specific error condition gracefully, resulting in an unhandled exception that propagates back as an HTTP 500 Internal Server Error and leaks stack trace data.

An inspection of the vulnerable codebase in internal/sbi/processor/ue_authentication.go reveals that the supiOrSuci variable was retrieved and directly formatted into the UDM destination URL string.

// Vulnerable Code Path
func (p *Processor) UeAuthPostRequestProcedure(c *gin.Context, updateAuthenticationInfo models.UpdateAuthenticationInfo) {
    ...
    supiOrSuci := updateAuthenticationInfo.SupiOrSuci
    // The value of supiOrSuci is immediately utilized without any format checks
    snName := updateAuthenticationInfo.ServingNetworkName
    ...
    udmURL := fmt.Sprintf("http://%s/nudm-ueau/v1/%s/security-information/...", udmAddr, supiOrSuci)
    // Go's net/url.Parse evaluates udmURL here, resulting in an unhandled parsing error
}

The patch introduced in commit bfc4a10094dbacbd862baa4686829f3fcc06ce1e inserts two validator functions to sanitize the incoming identifier.

// Patched Code Path
func (p *Processor) UeAuthPostRequestProcedure(c *gin.Context, updateAuthenticationInfo models.UpdateAuthenticationInfo) {
    ...
    supiOrSuci := updateAuthenticationInfo.SupiOrSuci
    // Added validation block to catch malformed inputs
    if !validator.IsValidSupi(supiOrSuci) && !validator.IsValidSuci(supiOrSuci) {
        logger.UeAuthLog.Warnf("invalid supiOrSuci in UE authentication request: %q", supiOrSuci)
        problemDetails := models.ProblemDetails{
            Title:  "Malformed request syntax",
            Status: http.StatusBadRequest,
            Detail: "supiOrSuci must be a valid SUPI or SUCI",
            Cause:  "MALFORMED_SUPI_OR_SUCI",
        }
        c.Set(sbi.IN_PB_DETAILS_CTX_STR, problemDetails.Cause)
        c.JSON(http.StatusBadRequest, problemDetails)
        return
    }
    snName := updateAuthenticationInfo.ServingNetworkName
    ...
}

This validator check ensures that the input conforms strictly to the structural rules of Subscriber Permanent Identifiers (SUPI) and Subscription Concealed Identifiers (SUCI). Any input containing non-conforming characters or control bytes is safely rejected before reaching the URL parser.

Exploitation of CVE-2026-53551 does not require prior authentication or specialized network permissions. The attacker needs only network-level access to the Service Based Interface (SBI) endpoint of the AUSF, typically hosted on TCP port 8000.

The attack vector involves sending a single HTTP POST request to /nausf-auth/v1/ue-authentications with a JSON payload where the supiOrSuci field contains null bytes. The structure of the exploit request is illustrated in the following sequence:

By repeatedly issuing this malformed request, an attacker can consume processing threads and memory resources as the service struggles with consecutive unhandled exceptions. This sequence effectively triggers a Denial of Service for all valid core network subscribers attempting to authenticate.

The impact of this vulnerability is categorized as a partial Denial of Service on a core network component. Since the AUSF is responsible for processing all user authentication requests, a disruption in this component prevents any new User Equipment (UE) from connecting to the 5G core.

In addition to service disruption, the vulnerability causes information disclosure. The Go runtime logs and returning payloads leak detailed system stack traces and error metadata that can aid attackers in mapping the internal network topology and component versions.

The CVSS v4.0 rating is calculated as 6.9, with a focus on low availability impact on the network service itself. Because free5GC is commonly used in private 5G deployments, enterprise networks, and testbed environments, the threat surface is localized to networks exposing the SBI endpoints.

The primary remediation path is upgrading the affected software components to versions containing the validation patch. Operators must transition to free5GC version 4.2.2 or higher, which includes AUSF version 1.4.5.

For environments where immediate system upgrades are not possible, operators should deploy an API Gateway or Web Application Firewall (WAF) in front of the AUSF SBI interface. The gateway must be configured to inspect HTTP/2 POST requests targeting /nausf-auth/v1/ue-authentications and discard payloads containing control characters.

Additionally, network segregation should be enforced. The Service Based Interface must be restricted to internal network segments (the 5G Core control plane) and isolated from the public internet or untrusted user-plane segments.