CVE-2026-106805
A resource exhaustion issue exists in Free5GC v4.2.3 during PFCP Session Establishment failure…
- Risk score
- 51/100
- CVSS
- 7.5 v3.1
- Exploit chance (30 days)
- 0.2%
- Published
- 2 Nov 2026
Open in the live forecast Today's forecast
What to know
- What it is
- A resource exhaustion issue exists in Free5GC v4.2.3 during PFCP Session Establishment failure handling. When the SMF does not receive a PFCP Session Establishment Response from the UPF, allocated UE IP address resources are not properly released. Repeated failed session establishment attempts can therefore exhaust th…
- Affected
- See advisory
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 7.5 high
- Remotely exploitable without logging in
References
Original description
A resource exhaustion issue exists in Free5GC v4.2.3 during PFCP Session Establishment failure handling. When the SMF does not receive a PFCP Session Establishment Response from the UPF, allocated UE IP address resources are not properly released. Repeated failed session establishment attempts can therefore exhaust the UE IP address pool, preventing new UEs from establishing PDU sessions and resulting in denial of service.
Last activity 2 Nov 2026. Patch Forecast updates every hour.