Skip to content
Free5gc vulnerabilities
Newest
-
free5gc
Free5GC Gmm handler.go race condition
CVE-2026-94043
6.9 Medium
-
free5gc
free5GC AUSF uses non-constant-time authentication comparisons and logs XRES* in 5G-AKA
CVE-2026-55785
Fix available
3.7 Low
-
free5gc
free5GC AUSF authentication contexts can be overwritten by concurrent requests for the same SUPI
CVE-2026-55784
7.5 High
-
free5gc
free5GC: NRF nnrf-nfm lacks NF Profile input validation — enables NF Registration Poisoning with arbitrary service endpoints
CVE-2026-55068
Fix available
9.3 Critical
-
free5gc smf
Simple Machines Forum < 2.1.7 Authorization Confusion via Profile::load()
CVE-2026-43621
Public exploit
8.6 High
-
free5gc ausf, free5gc +1 more
free5GC AUSF: null byte injection in supiOrSuci causes HTTP 500 internal service failure
CVE-2026-53551
Fix available
6.9 Medium
-
free5gc smf
Simple Machines Forum SSRF via image proxy
CVE-2026-61520
6.3 Medium
-
free5gc smf
Simple Machines Forum Authorization Bypass via AttachmentApprove.php
CVE-2026-39903
7.1 High
-
free5gc udm, udr, ubiquiti inc efg +12 more +14 more
Under certain network configurations, a malicious actor with access to network could exploit an...
CVE-2026-48610
8.1 High
-
@clerk express, free5gc udm, udr +29 more +31 more
A malicious actor with access to the network and low privileges could exploit an Improper Input...
CVE-2026-47370
9.9 Critical
-
@clerk express, free5gc udm, udr +29 more +31 more
A malicious actor with access to the network and low privileges could exploit an Improper Input...
CVE-2026-47369
9.9 Critical
-
@clerk express, free5gc udm, udr +29 more +31 more
A malicious actor with access to the network could exploit a Path Traversal vulnerability found...
CVE-2026-47368
8.6 High
-
free5gc
free5GC: UDR Improper ueId validation in free5GC EE subscription handlers allows arbitrary identifier persistence
CVE-2026-47780
6.9 Medium
-
free5gc udm, udr, ubiquiti inc efg +58 more +60 more
A malicious actor with access to the network and low privileges could exploit a Path Traversal...
CVE-2026-34911
7.7 High
-
ubiquiti unifi os, free5gc udm, udr +59 more +61 more
A malicious actor with access to the network could exploit an Improper Input Validation...
CVE-2026-34910
In KEVPublic exploit
EPSS 90.0%
10.0 Critical
-
ubiquiti unifi os, @clerk express, free5gc udm +61 more +63 more
A malicious actor with access to the network could exploit a Path Traversal vulnerability found...
CVE-2026-34909
In KEV
EPSS 69.2%
10.0 Critical
-
ubiquiti unifi os, free5gc udm, udr +59 more +61 more
A malicious actor with access to the network could exploit an Improper Access Control...
CVE-2026-34908
In KEVPublic exploit
EPSS 88.9%
10.0 Critical
-
free5gc
free5GC: NEF nnef-pfdmanagement API is unauthenticated; forged bearer tokens can read PFD data and create/delete PFD subscriptions
CVE-2026-44330
10.0 Critical
-
free5gc
free5GC: SMF UPI management interface lacks auth middleware; unauthenticated topology read/write requests reach handlers
CVE-2026-44329
Fix available
10.0 Critical
-
free5gc
free5GC: SMF UPI DELETE /upi/v1/upNodesLinks/{ref} panics on AN-node deletion via nil UPF dereference; unauthenticated, state-mutating
CVE-2026-44328
Fix available
8.2 High
-
free5gc
free5GC: NEF nnef-oam route group is unauthenticated; no-token requests reach the OAM handler
CVE-2026-44327
10.0 Critical
-
free5gc
free5GC: NEF 3gpp-traffic-influence API is unauthenticated; missing or forged bearer tokens can create, read, patch, and delete subscriptions
CVE-2026-44326
9.4 Critical
-
free5gc
free5GC: NRF POST /oauth2/token structured-form parser type-confusion panic family (Reflect.Set on incompatible types)
CVE-2026-44325
Fix available
7.5 High
-
free5gc
free5GC: UDR nudr-dr DELETE amf-subscriptions panics on missing UE state via nil interface type assertion (single authenticated request)
CVE-2026-44324
Fix available
6.5 Medium
-
free5gc
free5GC: UDR nudr-dr DELETE amf-subscriptions panics on missing subsId when UE state exists (nil pointer dereference)
CVE-2026-44323
Fix available
4.3 Medium
-
free5gc
free5GC: NEF 3gpp-pfd-management PATCH applications/{appId} panics on UDR access failure due to nil ProblemDetails dereference
CVE-2026-44322
Fix available
7.5 High
-
free5gc
free5GC: SMF UPI POST /upi/v1/upNodesLinks exits the SMF process on overlapping UE pools (unauthenticated, reachable Fatalf)
CVE-2026-44321
7.5 High
-
free5gc
free5GC: NEF nnef-callback route group is unauthenticated; forged callback requests are accepted into the processing path
CVE-2026-44320
7.3 High
-
free5gc
free5GC: NEF crashes via logger.Fatal on PFD notification delivery failure (attacker-controlled notifyUri)
CVE-2026-44319
Fix available
7.5 High
-
free5gc
free5GC: BSF concurrent PUT /nbsf-management/v1/subscriptions/{subId} crashes the BSF process via concurrent map read/write on Subscriptions
CVE-2026-44318
Fix available
6.5 Medium
-
free5gc
free5GC: PCF npcf-policyauthorization POST /app-sessions panics on suppFeat=1 with missing AfRoutReq via nil pointer dereference
CVE-2026-44317
Fix available
6.5 Medium
-
free5gc
free5GC: PCF npcf-smpolicycontrol POST /sm-policies panics on downstream UDR/OpenAPI 404 via nil pointer dereference
CVE-2026-44316
Fix available
7.5 High
-
free5gc
free5GC: NEF 3gpp-pfd-management API is unauthenticated; forged bearer tokens can create, read, and delete PFD transactions
CVE-2026-44315
9.4 Critical
-
free5gc
free5GC: Improper Input Validation and Generation of Error Message Containing Sensitive Information in github.com/free5gc/udm
CVE-2026-42459
7.7 High
-
free5gc
free5GC: PCF Npcf_SMPolicyControl missing authentication middleware allows unauthenticated access to SM policy handlers and disclosure of subscriber SUPI
CVE-2026-42083
Fix available
8.2 High
-
free5gc
free5GC: Missing Concurrent NAS SMC Validation During NGAP Handover
CVE-2026-42082
3.7 Low
-
free5gc
free5GC: UE Security Capability bypass on NGAP PathSwitchRequest
CVE-2026-42081
6.1 Medium
-
free5gc amf, free5gc +1 more
free5GC AMF missing default case in Content-Type switch in HTTPUEContextTransfer
CVE-2026-41136
5.5 Medium
-
free5gc, free5gc pcf +1 more
free5GC PCF: Memory Leak via CORS Middleware Registration in HTTP Handler Leads to Denial of Service
CVE-2026-41135
Fix available
7.5 High
-
free5gc, free5gc udr +1 more
free5GC UDR: Fail-open handling in PolicyDataSubsToNotifyPost allows unintended subscription creation
CVE-2026-40343
6.9 Medium
-
free5gc
free5gc UDR fail-open request handling in PolicyDataSubsToNotifySubsIdPut may allow unintended subscription updates after input errors
CVE-2026-40249
6.9 Medium
-
free5gc
free5gc UDR improper path validation allows unauthenticated creation and modification of Traffic Influence Subscriptions
CVE-2026-40248
8.7 High
-
free5gc
free5gc UDR improper path validation allows unauthenticated access to Traffic Influence Subscriptions
CVE-2026-40247
8.7 High
-
free5gc, free5gc webconsole +1 more
free5gc UDR improper path validation allows unauthenticated deletion of Traffic Influence Subscriptions
CVE-2026-40246
8.7 High
-
free5gc
Free5GC: UDR nudr-dr influenceData/subs-to-notify leaks SUPI in error response body without authentication
CVE-2026-40245
7.5 High
-
free5gc
Free5GC NGSetupRequest denial of service
CVE-2026-5661
6.9 Medium
-
free5gc
Free5GC aper type confusion
CVE-2026-5360
6.3 Medium
-
free5gc
An issue in Free5GC v.4.2.0 and before allows a remote attacker to cause a denial of service via...
CVE-2026-30653
7.5 High
-
free5gc
Free5GC AMF handler.go HandleRegistrationComplete denial of service
CVE-2026-4531
Fix available
6.9 Medium
-
free5gc, free5gc udm +1 more
free5GC UDM incorrectly returns 500 for empty supi path parameter in PATCH sdm-subscriptions reques
CVE-2026-33192
Fix available
8.7 High
- Show olderLoading…