Threats affecting pkg:github/free5gc/ausf

CVE-2026-33063 is a high-severity vulnerability in free5GC AUSF versions prior to 1.4.2, caused by improper null pointer handling in the UE authentication service. A remote attacker can send a crafted UE authentication request to the `/nausf-auth/v1/ue-authentications` endpoint, triggering a nil interface conversion in the `GetSupiFromSuciSupiMap` function. This causes the AUSF service to panic and crash, resulting in a denial of service (DoS). The root cause is the lack of a nil check before converting an interface{} to a pointer type, leading to a runtime panic. There is no direct application-level workaround, so patching to version 1.4.2 or later is essential. Restricting access to the AUSF API to trusted sources can mitigate exposure.