Threats affecting pkg:github/free5gc/pcf

CVE-2026-41135 is a memory leak vulnerability in free5GC's Policy Control Function (PCF) affecting versions prior to 1.4.3. An unauthenticated attacker with network access to the PCF SBI interface can cause uncontrolled memory growth by repeatedly sending HTTP requests to the OAM endpoint. This occurs because a new CORS middleware is registered on every incoming request, causing the Gin router's handler chain to grow indefinitely. The resulting memory exhaustion leads to denial of service, preventing user equipment from obtaining necessary policies and blocking 5G session establishment. Version 1.4.3 includes a patch to fix this issue.