CVE-2026-53551 is a pre-authentication denial-of-service in free5GC's AUSF component that allows an unauthenticated attacker to crash authentication for every subscriber served by the affected AUSF instance. The vulnerability lives in how the supiOrSuci field from incoming JSON is interpolated into a URL path for the AUSF-UDM interface. When that field contains null bytes or other URL-invalid characters, Go's net/url.Parse returns an error, causing UDM to return HTTP 500 with full stack traces — which both leaks internal system details and blocks all legitimate authentication attempts until the service is restarted.
The root cause is a validation gap at a service boundary that was designed as an internal interface but uses JSON as its serialization layer. JSON parsing preserves control characters exactly; URL path construction requires strict character validation. These are different safety contracts that no one explicitly mapped. The fix in free5GC 1.4.5 adds URL-safe validation in AUSF before constructing the UDM request — but this was never specified as a requirement because the trust model was assumed rather than designed.
Check your free5GC deployment: if you're on 1.4.4 or earlier, verify that supiOrSuci fields from incoming requests never reach UDM without validation. Even if your deployment is internal-only or behind a carrier-grade firewall, treat this as a priority patch — the EPSS score is low only because 5G core deployments are specialized, not because the vulnerability is hard to exploit. A single crafted request with a null byte in the subscriber identifier will 500 every auth attempt systemwide, and the stack trace in the response gives attackers fingerprinting information about your Go version and internal paths. The attack surface is any endpoint that accepts subscriber identifiers and forwards them to AUSF — typically NAS-layer gateways or edge UEs if your deployment exposes any of that traffic.