Login Request a demo
OP
Product
open5gs
by open5gs · last CVE Oct 26, 2026
202
CVEs
0
On KEV
9.8
Max CVSS
6
New 30D
Vulnerabilities202In the news0Timeline
Severity mix
Critical 5High 87Medium 103Low 7
Severity
All severities202Critical5High87Medium103Low7
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add open5gs to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-2522
9.8
1%
Feb 15
Open5GS MME esm-build.c memory corruption
Affected: 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; 2.7.5; +1 more
CVE-2026-2521
9.8
1%
Feb 15
Open5GS SGW-C sgwc_s5c_handle_create_session_response memory corruption
Affected: 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; 2.7.5; +1 more
CVE-2024-40130
9.8
1%
Jul 16
open5gs v2.6.4 is vulnerable to Buffer Overflow
Affected: 2.6.4
CVE-2024-40129
9.8
0%
Jul 16
Open5GS v2.6.4 is vulnerable to Buffer Overflow
Affected: 2.6.4
CVE-2021-28122
9.8
4%
Mar 10
A request-validation issue was discovered in Open5GS 2.1.3 through 2.2.x before 2.2.1
Affected: 2.1.3 through 2.2.0
CVE-2021-25863
8.8
1%
Jan 26
Open5GS 2.1.3 listens on 0.0.0.0:3000 and has a default password of 1423 for the admin account
Affected: 2.1.3
CVE-2026-15720
8.6
1%
Jul 14
Pre-auth heap out-of-bounds read in the AMF NAS 5GS mobile-identity handler
Affected: through 2.7.7
CVE-2024-24429
8.6
1%
Jan 22
A reachable assertion in the nas_eps_send_emm_to_esm function of Open5GS <= 2.6.4 allows attackers to cause a Denial of Service (DoS) via a crafted NGAP packet
Affected: through 2.6.4
CVE-2024-34235
8.6
1%
Jan 22
Open5GS MME versions <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface
Affected: through 2.6.4
CVE-2023-37023
8.6
1%
Jan 22
Open5GS MME versions <= 2.6.4 contain a reachable assertion in the `Uplink NAS Transport` packet handler
Affected: through 2.6.4
CVE-2023-37021
8.6
1%
Jan 22
Open5GS MME version <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface
Affected: through 2.6.4
CVE-2023-37020
8.6
1%
Jan 22
Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface
Affected: through 2.6.4
CVE-2023-37019
8.6
1%
Jan 22
Open5GS MME versions <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface
Affected: through 2.6.4
CVE-2023-37018
8.6
1%
Jan 22
Open5GS MME versions <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface
Affected: through 2.6.4
CVE-2023-37017
8.6
1%
Jan 22
Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface
Affected: through 2.6.4
CVE-2023-37016
8.6
1%
Jan 22
Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface
Affected: through 2.6.4
CVE-2023-37015
8.6
1%
Jan 22
Open5GS MME versions <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface
Affected: through 2.6.4
CVE-2026-90707
8.3
1%
Sep 14
Open5GS Old AMF Discovery Fallback nnrf-handler.c amf_nnrf_try_old_amf_discovery_fallback use after free
Affected: 2.0; 2.1; 2.2; 2.3; 2.4; 2.5; +2 more
CVE-2025-15555
8.2
1%
Feb 4
A security flaw has been discovered in Open5GS up to 2.7.6
Affected: through 2.7.6
CVE-2025-44952
7.8
0%
Jun 18
A missing length check in `ogs_pfcp_subnet_add` function from PFCP library, used by both smf and upf in open5gs 2.7.2 and earlier, allows a local attacker to cause a Buffer…
Affected: through 2.7.2
CVE-2026-116543
New
7.5
0%
Oct 26
Open5GS 1.3.0 through 2.8.0 Heap Out-of-Bounds Write via SBI Multipart Parser
Affected: 1.3.0 through 2.8.0
CVE-2026-8226
7.5
0%
May 10
Open5GS types.c ogs_pcc_rule_install_flow_from_media denial of service
Affected: 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; 2.7.5; +2 more
CVE-2026-8225
7.5
0%
May 10
Open5GS delete Endpoint sm-sm.c pcf_npcf_smpolicycontrol_handle_delete denial of service
Affected: 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; 2.7.5; +2 more
CVE-2026-8224
7.5
1%
May 10
Open5GS PCF context.c pcf_sess_set_ipv6prefix denial of service
Affected: 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; 2.7.5; +2 more
CVE-2026-8223
7.5
0%
May 10
Open5GS sm-policies Endpoint pcf_sess_sbi_discover_and_send denial of service
Affected: 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; 2.7.5; +2 more
CVE-2026-8222
7.5
1%
May 10
Open5GS sm-policies Endpoint nbsf-handler.c pcf_nbsf_management_handle_register denial of service
Affected: 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; 2.7.5; +2 more
CVE-2026-8186
7.5
1%
May 9
Open5GS NF client.c ogs_sbi_client_send_via_scp_or_sepp out-of-bounds
Affected: 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; 2.7.5; +2 more
CVE-2026-8187
7.5
1%
May 9
Open5GS UPF gtp-path.c _gtpv1_u_recv_cb resource consumption
Affected: 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; 2.7.5; +2 more
CVE-2026-4240
7.5
1%
Mar 16
Open5GS CCA smf_s6b_sta_cb denial of service
Affected: 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; 2.7.5; +1 more
CVE-2026-2524
7.5
1%
Feb 16
Open5GS MME mme_s11_handle_create_session_response denial of service
Affected: 2.7.6
CVE-2026-2523
7.5
1%
Feb 16
Open5GS SMF gn-handler.c smf_gn_handle_create_pdp_context_request assertion
Affected: 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; 2.7.5; +1 more
CVE-2026-2517
7.5
1%
Feb 15
Open5GS SMF types.c ogs_gtp2_parse_tft denial of service
Affected: 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; 2.7.5; +1 more
CVE-2026-2062
7.5
1%
Feb 6
A vulnerability was identified in Open5GS up to 2.7.6
Affected: through 2.7.0
CVE-2026-1587
7.5
1%
Jan 29
A vulnerability has been found in Open5GS up to 2.7.6
Affected: through 2.7.6
CVE-2026-1586
7.5
1%
Jan 29
A flaw has been found in Open5GS up to 2.7.5
Affected: before 2.7.6
CVE-2026-1522
7.5
1%
Jan 28
A weakness has been identified in Open5GS up to 2.7.6
Affected: through 2.7.6
CVE-2026-1521
7.5
1%
Jan 28
A security flaw has been discovered in Open5GS up to 2.7.6
Affected: through 2.7.6
CVE-2025-15539
7.5
1%
Jan 19
A vulnerability was determined in Open5GS up to 2.7.6
Affected: through 2.7.6
CVE-2025-15532
7.5
1%
Jan 17
A security flaw has been discovered in Open5GS up to 2.7.5
Affected: through 2.7.5
CVE-2025-15530
7.5
1%
Jan 17
A vulnerability was determined in Open5GS up to 2.7.6
Affected: through 2.7.6
CVE-2025-15529
7.5
1%
Jan 16
A vulnerability was found in Open5GS up to 2.7.6
Affected: through 2.7.6
CVE-2025-15528
7.5
1%
Jan 16
A vulnerability has been found in Open5GS up to 2.7.6
Affected: through 2.7.6
CVE-2025-15176
7.5
1%
Dec 29
A flaw has been found in Open5GS up to 2.7.5
Affected: through 2.7.5
CVE-2025-65559
7.5
0%
Dec 18
An issue was discovered in Open5GS 2.7.5-49-g465e90f, when processing a PFCP Session Establishment Request (type=50), the UPF crashes with a reachable assertion in…
Affected: 2.7.5
CVE-2025-63288
7.5
0%
Nov 10
In Open5GS 2.7.6, AMF crashes when receiving an abnormal NGSetupRequest message, resulting in denial of service
Affected: 2.7.6
CVE-2025-41068
7.5
0%
Oct 27
Reachable Assertion vulnerability in Open5GS up to version 2.7.6 allows attackers with connectivity to the NRF to cause a denial of service
Affected: before 2.7.5
CVE-2025-41067
7.5
0%
Oct 27
Reachable Assertion vulnerability in Open5GS up to version 2.7.6 allows attackers with connectivity to the NRF to cause a denial of service
Affected: before 2.7.5
CVE-2025-52322
7.5
1%
Sep 9
An issue in Open5GS v2.7.2 and before allows a remote attacker to cause a denial of service via a crafted Create Session Request message to the SMF (PGW-C), using the IP address…
Affected: through 2.7.2
CVE-2025-52288
7.5
0%
Sep 8
Assertion failure in function ngap_build_downlink_nas_transport in file src/amf/ngap-build.c, the Access and Mobility Management Function (AMF) component, in Open5GS thru 2.7.5…
Affected: through 2.7.5
CVE-2025-8805
7.5
1%
Aug 10
A vulnerability was determined in Open5GS up to 2.7.5
Affected: before 2.7.6
Page 1 of 5 · 202 total
12…5