{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"1.2.3"}],"component":"github.com/free5gc/nef","cve_ids":["CVE-2026-44320"],"ecosystem":"Go","epss":0.00241,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-wqfh-gq79-j8mf","id":"tcs_01M5KFR1C09B23NPVBREH4SK1H","modified_at":"2026-06-25T23:11:41.845125863Z","published_at":"2026-05-08T22:46:37Z","references":["https://osv.dev/vulnerability/GHSA-wqfh-gq79-j8mf","https://github.com/free5gc/free5gc/security/advisories/GHSA-wqfh-gq79-j8mf","https://nvd.nist.gov/vuln/detail/CVE-2026-44320","https://github.com/free5gc/free5gc/issues/860","https://github.com/free5gc/nef/pull/24","https://github.com/free5gc/free5gc"],"severity":{"label":"high","score":7.3},"sources":[{"source":"osv","source_id":"GHSA-wqfh-gq79-j8mf","url":"https://osv.dev/vulnerability/GHSA-wqfh-gq79-j8mf"}],"summary":"free5GC's NEF nnef-callback route group is unauthenticated; forged callback requests are accepted into the processing path"}