high7.5
CVE-2025-60638
NSSF panic due to nil pointer dereference when expiry field is omitted in NSSAIAvailability POST
Impact
An issue was discovered in Free5GC v4.0.0 and v4.0.1 allowing an attacker to cause a denial of service via crafted POST request to the Nnssf_NSSAIAvailability API.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/free5gc/nssf | < 1.4.0 | 1.4.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Free5gc | Free5gc | Versions 4.0.0, 4.0.1 |