Threats affecting pkg:golang/github.com/free5gc/chf

CVE-2026-32937 is a high-severity vulnerability in free5GC's CHF component prior to version 1.2.2, caused by improper validation of array indexes leading to out-of-bounds slice access. An authenticated attacker can trigger a server-side panic via a crafted PUT request to the recharge endpoint, causing service disruption. While some deployments convert this panic into HTTP 500 errors, others may experience more severe outages. The vulnerability can be exploited repeatedly to degrade recharge functionality and flood logs, impacting availability. Mitigations include restricting access to trusted network functions, applying rate limiting, disabling the recharge API if unused, and ensuring panic recovery and monitoring are in place. This vulnerability affects 5G core network deployments using free5GC CHF, particularly in countries with active 5G infrastructure adopting open-source core solutions. The CVSS 4.0 score is 7.