CVE-2026-1974

low-risk
Published 2026-02-06

A vulnerability was identified in Free5GC up to 4.1.0. This affects the function ResolveNodeIdToIp of the file internal/sbi/processor/datapath.go of the component SMF. The manipulation leads to denial of service. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. It is recommended to apply a patch to fix this issue.

Do I need to act?

-
0.11% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
5
CVSS 5.3/10 Medium
NETWORK / LOW complexity

Affected Products (1)

Affected Vendors

Free5Gc

References (7)

Product https://github.com/free5gc/free5gc/
Exploit https://github.com/free5gc/free5gc/issues/816
Exploit https://github.com/free5gc/free5gc/issues/816#issue-3832055233
Issue Tracking https://github.com/free5gc/smf/pull/189
Permissions Required https://vuldb.com/?ctiid.344496
Third Party Advisory https://vuldb.com/?id.344496
Exploit https://vuldb.com/?submit.743237
26
/ 100
low-risk
Severity 21/34 · High
Exploitability 0/34 · Minimal
Exposure 5/34 · Minimal