—
GO-2026-6316
free5GC NRF nnrf-nfm lacks NF Profile input validation — enables NF Registration Poisoning with arbitrary service endpoints in github.com/free5gc/free5gc
Quick fix
GO-2026-6316 — github.com/free5gc/free5gc: upgrade to the fixed version with the command below.
go get github.com/free5gc/free5gc@v4.2.2+incompatibleDetails
free5GC NRF nnrf-nfm lacks NF Profile input validation — enables NF Registration Poisoning with arbitrary service endpoints in github.com/free5gc/free5gc
Are you affected?
Enter the version of the package you're using.
Affected packages
Go/github.com/free5gc/free5gc
Introduced in:
0Fixed in: 4.2.2+incompatibleFix
go get github.com/free5gc/free5gc@v4.2.2+incompatibleReferences
- https://github.com/free5gc/free5gc/security/advisories/GHSA-x8mj-6p3q-g5pp[ADVISORY]
- https://github.com/free5gc/free5gc/issues/1056[REPORT]
- https://github.com/free5gc/free5gc/releases/tag/v4.2.3[WEB]
- https://github.com/free5gc/nrf/commit/bda0cf75be5556bb4c758c8b34710f3fe6bbe3ea[WEB]
- https://github.com/free5gc/nrf/commit/fcd3cfaa27cc4dc17172ee0c4c3e0a3a696297c6[WEB]
- https://github.com/free5gc/nrf/pull/90[WEB]
- https://github.com/free5gc/nrf/releases/tag/v1.4.5[WEB]