Skip to contentOpen5gs vulnerabilities
Newest
- open5gsOpen5GS SMF types.c ogs_gtp2_parse_tft denial of serviceCVE-2026-25176.9 Medium
- open5gsOpen5GS PGW S5U Address sgwc_sxa_handle_session_modification_response null pointer dereferenceCVE-2026-20626.9 Medium
- open5gsOpen5GS VoLTE Cx-Test hss-cx-path.c hss_ogs_diam_cx_mar_cb stack-based overflowCVE-2025-155556.9 Medium
- open5gsOpen5GS SGWC context.c sgwc_tunnel_add assertionCVE-2026-17386.9 Medium
- open5gsOpen5GS CreateBearerRequest s5c-handler.c sgwc_s5c_handle_create_bearer_request assertionCVE-2026-17376.9 Medium
- open5gsOpen5GS SGWC s11-handler.c assertionCVE-2026-17366.9 Medium
- open5gsOpen5GS SGWC s11-handler.c sgwc_s11_handle_modify_bearer_request denial of serviceCVE-2026-15876.9 Medium
- open5gsOpen5GS SGWC s11-handler.c ogs_gtp2_f_teid_to_ip denial of serviceCVE-2026-15866.9 Medium
- open5gsOpen5GS SGWC s5c-handler.c sgwc_s5c_handle_modify_bearer_response denial of serviceCVE-2026-15226.9 Medium
- open5gsOpen5GS SGWC s5c-handler.c denial of serviceCVE-2026-15216.9 Medium
- newplane open5gsOpen 5GS WebUI uses a hard-coded JWT signing keyCVE-2026-0622Public exploit6.5 Medium
- open5gsOpen5GS sgwc s11-handler.c sgwc_s11_handle_downlink_data_notification_ack denial of serviceCVE-2025-155396.9 Medium
- open5gsOpen5GS Timer resource consumptionCVE-2025-155326.9 Medium
- open5gsOpen5GS context.c sgwc_bearer_add assertionCVE-2025-155316.9 Medium
- open5gsOpen5GS s11-handler.c assertionCVE-2025-155306.9 Medium
- open5gsOpen5GS s5c-handler.c sgwc_s5c_handle_create_session_response denial of serviceCVE-2025-155296.9 Medium
- open5gsOpen5GS GTPv2 Bearer Response denial of serviceCVE-2025-155286.9 Medium
- open5gsOpen5GS GTPv2-C Flow s5c-handler.c sgwc_s5c_handle_create_session_response denial of serviceCVE-2025-154194.8 Medium
- open5gsOpen5GS Bearer QoS IE Length types.c ogs_gtp2_parse_bearer_qos denial of serviceCVE-2025-154184.8 Medium
- open5gsOpen5GS GTPv2-C F-TEID s11-handler.c sgwc_s11_handle_create_session_request denial of serviceCVE-2025-154174.8 Medium
- open5gsOpen5GS PFCP Session Establishment Request rule-match.c ogs_pfcp_pdr_rule_find_by_packet assertionCVE-2025-151766.9 Medium
- open5gsOpen5GS PFCP handler.c ogs_pfcp_handle_create_pdr initializationCVE-2025-149556.3 Medium
- open5gsOpen5GS QER/FAR/URR/PDR context.c ogs_pfcp_qer_find_or_add assertionCVE-2025-149546.3 Medium
- open5gsOpen5GS FAR-ID handler.c ogs_pfcp_handle_create_pdr null pointer dereferenceCVE-2025-149532.3 Low
- open5gsAn issue was discovered in Open5GS 2.7.5-49-g465e90f, when processing a PFCP Session...CVE-2025-655597.5 High
- open5gsIn Open5GS 2.7.6, AMF crashes when receiving an abnormal NGSetupRequest message, resulting in...CVE-2025-632887.5 High
- newplane open5gsReachable Assertion vulnerability in Open5GSCVE-2025-410688.7 High
- newplane open5gsReachable Assertion vulnerability in Open5GSCVE-2025-41067Public exploit8.7 High
- open5gsOpen5GS v2.7.5, prior to commit 67ba7f92bbd7a378954895d96d9d7b05d5b64615, is vulnerable to a NULL...CVE-2025-559044.0 Medium
- open5gsAn issue in Open5GS v2.7.2 and before allows a remote attacker to cause a denial of service via a...CVE-2025-523227.5 High
- open5gsAssertion failure in function ngap_build_downlink_nas_transport in file src/amf/ngap-build.c, the...CVE-2025-522887.5 High
- open5gsOpen5GS gmm-sm.c gmm_state_exception assertionCVE-2025-94056.9 Medium
- open5gsOpen5GS SMF gsm-sm.c smf_gsm_state_wait_pfcp_deletion denial of serviceCVE-2025-88056.9 Medium
- open5gsOpen5GS AMF ngap_build_downlink_nas_transport assertionCVE-2025-88046.9 Medium
- open5gsOpen5GS AMF gmm-sm.c gmm_state_exception denial of serviceCVE-2025-88036.9 Medium
- open5gsOpen5GS SMF smf-sm.c smf_state_operational denial of serviceCVE-2025-88026.9 Medium
- open5gsOpen5GS AMF gmm-sm.c gmm_state_exception denial of serviceCVE-2025-88016.9 Medium
- open5gsOpen5GS AMF esm-handler.c esm_handle_pdn_connectivity_request denial of serviceCVE-2025-88006.9 Medium
- open5gsOpen5GS AMF npcf-build.c amf_nsmf_pdusession_build_create_sm_context denial of serviceCVE-2025-87996.9 Medium
- open5gsOpen5GS AMF Service nsmf-handler.c amf_nsmf_pdusession_handle_release_sm_context assertionCVE-2025-86984.8 Medium
- open5gsOpen5GS SCTP Partial Message recv_handler assertionCVE-2025-74854.8 Medium
- open5gsOpen5GS AMF Service amf-sm.c amf_state_operational assertionCVE-2025-69524.8 Medium
- open5gsA missing length check in `ogs_pfcp_subnet_add` function from PFCP library, used by both smf and...CVE-2025-449527.8 High
- open5gsA missing length check in `ogs_pfcp_dev_add` function from PFCP library, used by both smf and upf...CVE-2025-449517.1 High
- open5gsAn issue in upf in open5gs 2.7.2 and earlier allows a remote attacker to cause a Denial of...CVE-2025-296467.1 High
- open5gsOpen5GS AMF/MME emm-sm.c common_register_state denial of serviceCVE-2025-59356.9 Medium
- open5gsOpen5GS AMF/MME emm_state_authentication assertionCVE-2025-55206.9 Medium
- open5gsOpen5GS NGAP PathSwitchRequest Message ngap-handler.c ngap_handle_path_switch_request_transfer assertionCVE-2025-55016.9 Medium
- open5gsAn issue in UPF in Open5GS UPF versions up to v2.7.2 results an assertion failure vulnerability...CVE-2025-293397.5 High
- open5gsAn issue was discovered in Open5GS v2.7.2. When a UE switches between two gNBs and sends a...CVE-2025-257746.5 Medium
- Show moreLoading…