Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Go package

github.com/free5gc/chf

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.1GoPublished

    Out-of-Bounds Slice Access in free5GC CHF Leading to DoS

    CVE-2026-32937 · GHSA-6g43-577r-wf4x

    Affected
    • Go github.com/free5gc/chf < 1.2.2
    Fixed in
    1.2.2· Vendor fix available
    Issue
    Impact This is an out-of-bounds slice access vulnerability in the CHF nchf-convergedcharging service. A valid authenticated request to PUT /nchf-convergedcharging/v3/recharging/:ueId?ratingGroup=... can trigger a server-side panic in github.com/free5gc/chf/internal/sbi.(Server).RechargePut(...) due to an out-of-range slice access. In the reported runtime, Gin recovery converts the panic into HTTP 500, but the recharge path remains remotely panic-triggerable and can be abused repeatedly to degrade recharge functionality and flood logs. In deployments without equivalent recovery handling, this panic may cause more severe service disruption. Patches https://github.com/free5gc/chf/pull/61 Workarounds - Restrict access to the nchf-convergedcharging recharge endpoint to strictly trusted NF callers only. - Apply rate limiting or network ACLs in front of the CHF SBI interface to reduce repeated panic-trigger attempts. - If the recharge API is not required, temporarily disable or block…

    Recommended action: Upgrade to 1.2.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →