---
id: CVE-2026-106805
title: >-
  A resource exhaustion issue exists in Free5GC v4.2.3 during PFCP Session
  Establishment failure handling
summary: >-
  A resource exhaustion issue exists in Free5GC v4.2.3 during PFCP Session
  Establishment failure handling. When the SMF does not receive a PFCP Session
  Establishment Response from the UPF, allocated UE IP address resources are not
  properly…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: adp
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-11-05T16:28:19.685560Z'
exploitAvailable: true
published: '2026-11-02'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T16:32:02.796Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-106805'
references:
  - url: 'https://github.com/free5gc/free5gc/issues/1162'
  - url: 'https://github.com/free5gc/smf/pull/236'
  - url: 'https://gist.github.com/hackeryounow/484987c16806c76dd53a8a87355dd0c2'
tags:
  - cve.org
  - exploit-available
epss: 0.00339
epssPercentile: 0.27483
ingestedAt: '2026-11-05T22:38:31.356Z'
---

## Overview

A resource exhaustion issue exists in Free5GC v4.2.3 during PFCP Session Establishment failure handling. When the SMF does not receive a PFCP Session Establishment Response from the UPF, allocated UE IP address resources are not properly released. Repeated failed session establishment attempts can therefore exhaust the UE IP address pool, preventing new UEs from establishing PDU sessions and resulting in denial of service.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.