CVE-2026-5661: Free5gc Ngap Missing Return After Failure

A failure message is sent but execution may continue because there is no immediate and explicit return in the same block. This leads to processing invalid messages, state mismatches, and potential resource DoS. Ensure an unconditional return follows the failure send.

Provally CuratedPublic repositoryHighMedium confidenceVerifiedApache-2.0Go
greprules fetch cve-2026-5661-free5gc-ngap-missing-return-after-failure --engine opengrep

Description

A failure message is sent but execution may continue because there is no immediate and explicit return in the same block. This leads to processing invalid messages, state mismatches, and potential resource DoS. Ensure an unconditional return follows the failure send.