CVE-2026-44328 affects free5GC, an open-source 5G core network implementation. Prior to version 4.2.2, the SMF component mounts UPI management routes without OAuth2 middleware authentication. The vulnerability allows unauthenticated attackers to send DELETE requests to /upi/v1/upNodesLinks/{upNodeRef} endpoint, causing nil-pointer panics and denial of service. The flaw also mutates in-memory user-plane topology before crashing, creating a state-mutating panic-DoS condition. Off-path network attackers can trigger this vulnerability by targeting any AN entry by name. The issue is resolved in free5GC version 4.2.2.