CVE-2026-44321 affects free5GC, an open-source 5G core network implementation. Prior to version 4.2.2, the SMF component mounts the UPI management route group without OAuth2 middleware protection. An unauthenticated attacker can send a malicious POST request to /upi/v1/upNodesLinks with crafted JSON that triggers validation failures in UpNodesFromConfiguration(). The UE-IP-pool overlap check causes logger.InitLog.Fatalf() to terminate the entire SMF process, creating a denial of service condition. The vulnerability allows complete SMF process termination through a single unauthenticated request, making it a high-severity issue for 5G network infrastructure. The issue is fixed in version 4.2.2.