CVE-2026-44319 affects free5GC, an open-source 5G core network implementation. Prior to version 4.2.2, the NEF (Network Exposure Function) component terminates the entire process when a PFD-subscription notifyUri cannot be reached. An attacker can create a PFD subscription with a malicious notifyUri and trigger a PFD change to deterministically kill the NEF process. The vulnerability occurs in PfdChangeNotifier.FlushNotifications() where delivery errors invoke logger.PFDManageLog.Fatal(err), equivalent to os.Exit(1) in Go. This causes the NEF's entire SBI surface to drop until restart. The issue has been fixed in version 4.2.2.