High severity · published Jan 30, 2026
CVE-2026-1683
Free5GC SMF PFCP handler.go HandlePfcpSessionReportRequest denial of service
7.5
CVSS
0.7%
EPSS
No
On KEV
Description
A vulnerability has been found in Free5GC SMF up to 4.1.0. Affected by this vulnerability is the function HandlePfcpSessionReportRequest of the file internal/pfcp/handler/handler.go of the component PFCP. The manipulation leads to denial of service. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. To fix this issue, it is recommended to deploy a patch.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 53% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SM
SMF · Free5GC
4.0; 4.1.0 · source: vendor
FR
Free5gc · Free5gc
through 4.1.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-1683
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-1683
Exploit
https://github.com/free5gc/free5gc/issues/804
Exploit
https://github.com/free5gc/free5gc/issues/804#issue-3816086696
github.com
https://github.com/free5gc/smf/
Issue Tracking
https://github.com/free5gc/smf/pull/188
Permissions Required
https://vuldb.com/?ctiid.343476
Third Party Advisory
https://vuldb.com/?id.343476
More from SMF
7.5
CVE-2026-26025
free5GC SMF crash (nil pointer dereference) on PFCP SessionReportRequest when ReportType.USAR=1 and UsageReport omits mandatory URRID sub-IE 
7.5
CVE-2026-26024
free5GC SMF crash (nil pointer dereference) on PFCP SessionReportRequest when ReportType.USAR=1 and UsageReport omits mandatory URRID sub-IE 
7.5
CVE-2026-25501
free5GC SMF crash (nil pointer dereference) on PFCP SessionReportRequest when ReportType.DLDR is set but DownlinkDataReport IE is missing
7.5
CVE-2025-69232
free5GC hasProtocol Compliance Violation in UPF Leading to SMF Service Disruption
7.5
CVE-2026-1684
Free5GC SMF PFCP UDP Endpoint pfcp_reports.go HandleReports denial of service