FR
Product
free5gc
72
CVEs
0
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 6High 43Medium 21Low 2
Watch
Add free5gc to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-47780 | 6.9 | Sep 15 | free5GC: UDR Improper ueId validation in free5GC EE subscription handlers allows arbitrary identifier persistence Affected: <= 4.2.2 |
| CVE-2026-53551 | 6.9 | Jul 31 | free5GC AUSF: null byte injection in supiOrSuci causes HTTP 500 internal service failure Affected: < 4.2.2 |
| CVE-2026-44317 | 6.5 | May 27 | free5GC: PCF npcf-policyauthorization POST /app-sessions panics on suppFeat=1 with missing AfRoutReq via nil pointer dereference Affected: < 4.2.2 |
| CVE-2026-44323 | 6.5 | May 27 | free5GC: UDR nudr-dr DELETE amf-subscriptions panics on missing subsId when UE state exists (nil pointer dereference) Affected: < 4.2.2 |
| CVE-2026-44324 | 6.5 | May 27 | free5GC: UDR nudr-dr DELETE amf-subscriptions panics on missing UE state via nil interface type assertion (single authenticated request) Affected: < 4.2.2 |
| CVE-2026-32937 | 6.5 | Mar 20 | free5GC CHF has Out-of-Bounds Slice Access that Leads to DoS Affected: before 1.2.2 |
| CVE-2025-60632 | 6.5 | Nov 24 | An issue was discovered in Free5GC v4.0.0 and v4.0.1 allowing an attacker to cause a denial of service via crafted POST request to the Npcf_BDTPolicyControl API Affected: 4.0.0; 4.0.1 |
| CVE-2025-60633 | 6.5 | Nov 24 | An issue was discovered in Free5GC v4.0.0 and v4.0.1 allowing an attacker to cause a denial of service via the Nudm_SubscriberDataManagement API Affected: 4.0.0; 4.0.1 |
| CVE-2026-40343 | 5.8 | Apr 21 | free5GC UDR: Fail-open handling in PolicyDataSubsToNotifyPost allows unintended subscription creation Affected: through 4.2.1 |
| CVE-2023-47025 | 5.5 | Nov 16 | An issue in Free5gc v.3.3.0 allows a local attacker to cause a denial of service via the free5gc-compose component Affected: 3.3.0 |
| CVE-2022-43677 | 5.5 | Oct 24 | In free5GC 3.2.1, a malformed NGAP message can crash the AMF and NGAP decoders via an index-out-of-range panic in aper.GetBitString Affected: 3.2.1 |
| CVE-2026-42082 | 5.4 | May 27 | free5GC: Missing Concurrent NAS SMC Validation During NGAP Handover Affected: < 4.2.2 |
| CVE-2025-29632 | 5.4 | May 29 | Buffer Overflow vulnerability in Free5gc v.4.0.0 allows a remote attacker to cause a denial of service via the AMF, NGAP, security.go, handler_generated.go,… Affected: 4.0.0 |
| CVE-2026-94043 | 5.3 | Sep 20 | Free5GC Gmm handler.go race condition Affected: 4.2.0; 4.2.1; 4.2.2; 4.2.3 |
| CVE-2026-44318 | 5.3 | May 27 | free5GC: BSF concurrent PUT /nbsf-management/v1/subscriptions/{subId} crashes the BSF process via concurrent map read/write on Subscriptions Affected: < 4.2.2 |
| CVE-2026-41136 | 5.3 | Apr 21 | free5GC AMF missing default case in Content-Type switch in HTTPUEContextTransfer Affected: through 4.2.1 |
| CVE-2026-40249 | 5.3 | Apr 16 | free5gc UDR fail-open request handling in PolicyDataSubsToNotifySubsIdPut may allow unintended subscription updates after input errors Affected: <= 4.2.1 |
| CVE-2026-5661 | 5.3 | Apr 6 | Free5GC NGSetupRequest denial of service Affected: 4.2.0 |
| CVE-2026-4531 | 5.3 | Mar 22 | Free5GC AMF handler.go HandleRegistrationComplete denial of service Affected: 4.1.0 |
| CVE-2026-33192 | 5.3 | Mar 20 | free5GC UDM incorrectly returns 500 for empty supi path parameter in PATCH sdm-subscriptions reques Affected: < 1.4.2 |
| CVE-2026-33065 | 5.3 | Mar 20 | free5GC UDM incorrectly returns 500 for empty supi path parameter in DELETE sdm-subscriptions request Affected: < 1.4.2 |
Showing 21