CVE-2026-44319 affects free5GC, an open-source 5G core network implementation. The vulnerability exists in versions prior to 4.2.2 where the NEF (Network Exposure Function) component terminates the entire process when a PFD-subscription notifyUri cannot be reached. An attacker can create a PFD subscription with a malicious notifyUri and trigger a PFD change to deterministically kill the NEF process. This results in a denial of service as the process exits with status 1, dropping NEF's entire SBI surface until manual restart. The vulnerability has been fixed in version 4.2.2.