{"schema_version":"1.7.5","id":"GHSA-6g43-577r-wf4x","published":"2026-03-18T17:26:27Z","modified":"2026-03-23T18:56:24.524579Z","aliases":["CVE-2026-32937","GO-2026-4750"],"summary":"Out-of-Bounds Slice Access in free5GC CHF Leading to DoS","details":"### Impact\nThis is an out-of-bounds slice access vulnerability in the CHF `nchf-convergedcharging` service.\nA valid authenticated request to PUT `/nchf-convergedcharging/v3/recharging/:ueId?ratingGroup=...` can trigger a server-side panic in `github.com/free5gc/chf/internal/sbi.(*Server).RechargePut(...)` due to an out-of-range slice access. In the reported runtime, Gin recovery converts the panic into HTTP 500, but the recharge path remains remotely panic-triggerable and can be abused repeatedly to degrade recharge functionality and flood logs. In deployments without equivalent recovery handling, this panic may cause more severe service disruption.\n\n### Patches\nhttps://github.com/free5gc/chf/pull/61\n\n### Workarounds\n- Restrict access to the `nchf-convergedcharging` recharge endpoint to strictly trusted NF callers only.\n- Apply rate limiting or network ACLs in front of the CHF SBI interface to reduce repeated panic-trigger attempts.\n- If the recharge API is not required, temporarily disable or block external reachability to this route.\n- Ensure panic recovery, monitoring, and alerting are enabled.","affected":[{"package":{"name":"github.com/free5gc/chf","ecosystem":"Go","purl":"pkg:golang/github.com/free5gc/chf"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.2.2"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-6g43-577r-wf4x/GHSA-6g43-577r-wf4x.json"}}],"references":[{"type":"WEB","url":"https://github.com/free5gc/free5gc/security/advisories/GHSA-6g43-577r-wf4x"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32937"},{"type":"WEB","url":"https://github.com/free5gc/free5gc/issues/864"},{"type":"WEB","url":"https://github.com/free5gc/chf/pull/61"},{"type":"WEB","url":"https://github.com/free5gc/chf/commit/55af766f321a00afa978e806548c96f8a7d2433e"},{"type":"PACKAGE","url":"https://github.com/free5gc/chf"}],"database_specific":{"cwe_ids":["CWE-129"],"github_reviewed":true,"github_reviewed_at":"2026-03-18T17:26:27Z","nvd_published_at":"2026-03-20T03:16:00Z","severity":"HIGH"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}]}