Educational security lab with HTTP endpoints that trigger known CVE crash paths in free5GC AMF and PCF network functions—designed for demonstrating impact, observing logs, and explaining root causes.
Signaux d'expérience
Étapes documentées, notes d'architecture et résultats du processus de recherche.
This lab provides a controlled environment for demonstrating three availability vulnerabilities in the free5GC 5G core network functions. Each endpoint triggers a known crash or memory-growth path so observers can see the impact, analyze logs, and understand the root cause.
The lab is educational—not an exploit toolkit. Endpoints are synthetic triggers that exercise specific code paths documented in CVE reports.
The lab runs free5GC via Docker Compose with the GTP5G kernel module (v0.9.5) for UPF support. MongoDB 4.4 is used for compatibility with CPUs lacking AVX instructions.
The recommended demo sequence triggers one vulnerability at a time, observes container logs, and documents the crash or memory growth pattern before proceeding to the next.
# 1. PCF memory growth
curl http://localhost:29503/noam-pcf/v1/config # repeat 100x
# 2. AMF registration panic
curl http://localhost:29518/vulnerable/registration-complete
# 3. AMF auth failure panic
curl http://localhost:29518/vulnerable/auth-failure
# Observe
docker logs pcf
docker logs amfCVE-2026-41135 occurs because the PCF handler calls router.Use(cors...) inside the request handler, registering a new middleware instance per request. Over hundreds of requests, memory grows until the process becomes unstable.
CVE-2026-4531 and CVE-2026-30653 are nil pointer dereferences in GMM handlers that assume registration state or IE presence without validation.
