An issue in the ModifyAMFEventSubscriptionProcedure function (processor/event_exposure.go) of free5gc v4.1.0 allows attackers to cause a Denial of Service (DoS)…

CVE-2026-30050 is a Denial of Service vulnerability found in free5gc v4.1.0, an open-source 5G core network implementation. The flaw exists in the ModifyAMFEventSubscriptionProcedure function within the processor/event_exposure.go file. Attackers can exploit this vulnerability by sending a specially crafted PATCH request to trigger a DoS condition. The vulnerability was reported via the free5gc GitHub issue tracker. No authentication bypass or data exfiltration is described, but service availability is at risk. The affected component relates to AMF (Access and Mobility Management Function) event subscription handling, a critical part of 5G network signaling. This could impact telecommunications infrastructure relying on free5gc for 5G core services. A fix or patch status was not explicitly mentioned in the article.