OP
Product
open5gs
202
CVEs
0
On KEV
9.8
Max CVSS
6
New 30D
Severity mix
Critical 5High 87Medium 103Low 7
Watch
Add open5gs to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-25863 | 8.8 | Jan 26 | Open5GS 2.1.3 listens on 0.0.0.0:3000 and has a default password of 1423 for the admin account Affected: 2.1.3 |
| CVE-2026-15720 | 8.6 | Jul 14 | Pre-auth heap out-of-bounds read in the AMF NAS 5GS mobile-identity handler Affected: through 2.7.7 |
| CVE-2024-24429 | 8.6 | Jan 22 | A reachable assertion in the nas_eps_send_emm_to_esm function of Open5GS <= 2.6.4 allows attackers to cause a Denial of Service (DoS) via a crafted NGAP packet Affected: through 2.6.4 |
| CVE-2024-34235 | 8.6 | Jan 22 | Open5GS MME versions <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface Affected: through 2.6.4 |
| CVE-2023-37023 | 8.6 | Jan 22 | Open5GS MME versions <= 2.6.4 contain a reachable assertion in the `Uplink NAS Transport` packet handler Affected: through 2.6.4 |
| CVE-2023-37021 | 8.6 | Jan 22 | Open5GS MME version <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface Affected: through 2.6.4 |
| CVE-2023-37020 | 8.6 | Jan 22 | Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface Affected: through 2.6.4 |
| CVE-2023-37019 | 8.6 | Jan 22 | Open5GS MME versions <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface Affected: through 2.6.4 |
| CVE-2023-37018 | 8.6 | Jan 22 | Open5GS MME versions <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface Affected: through 2.6.4 |
| CVE-2023-37017 | 8.6 | Jan 22 | Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface Affected: through 2.6.4 |
| CVE-2023-37016 | 8.6 | Jan 22 | Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface Affected: through 2.6.4 |
| CVE-2023-37015 | 8.6 | Jan 22 | Open5GS MME versions <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface Affected: through 2.6.4 |
| CVE-2026-90707 | 8.3 | Sep 14 | Open5GS Old AMF Discovery Fallback nnrf-handler.c amf_nnrf_try_old_amf_discovery_fallback use after free Affected: 2.0; 2.1; 2.2; 2.3; 2.4; 2.5; +2 more |
| CVE-2025-15555 | 8.2 | Feb 4 | Open5GS VoLTE Cx-Test hss-cx-path.c hss_ogs_diam_cx_mar_cb stack-based overflow Affected: 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; 2.7.5; +1 more |
| CVE-2025-44952 | 7.8 | Jun 18 | A missing length check in `ogs_pfcp_subnet_add` function from PFCP library, used by both smf and upf in open5gs 2.7.2 and earlier, allows a local attacker to cause a Buffer… Affected: through 2.7.2 |
| CVE-2026-116543 New | 7.5 | Oct 26 | Open5GS 1.3.0 through 2.8.0 Heap Out-of-Bounds Write via SBI Multipart Parser Affected: 1.3.0 through 2.8.0 |
| CVE-2026-8226 | 7.5 | May 10 | Open5GS types.c ogs_pcc_rule_install_flow_from_media denial of service Affected: 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; 2.7.5; +2 more |
| CVE-2026-8225 | 7.5 | May 10 | Open5GS delete Endpoint sm-sm.c pcf_npcf_smpolicycontrol_handle_delete denial of service Affected: 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; 2.7.5; +2 more |
| CVE-2026-8224 | 7.5 | May 10 | Open5GS PCF context.c pcf_sess_set_ipv6prefix denial of service Affected: 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; 2.7.5; +2 more |
| CVE-2026-8223 | 7.5 | May 10 | Open5GS sm-policies Endpoint pcf_sess_sbi_discover_and_send denial of service Affected: 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; 2.7.5; +2 more |
| CVE-2026-8222 | 7.5 | May 10 | Open5GS sm-policies Endpoint nbsf-handler.c pcf_nbsf_management_handle_register denial of service Affected: 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; 2.7.5; +2 more |
| CVE-2026-8186 | 7.5 | May 9 | Open5GS NF client.c ogs_sbi_client_send_via_scp_or_sepp out-of-bounds Affected: 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; 2.7.5; +2 more |
| CVE-2026-8187 | 7.5 | May 9 | Open5GS UPF gtp-path.c _gtpv1_u_recv_cb resource consumption Affected: 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; 2.7.5; +2 more |
| CVE-2026-4240 | 7.5 | Mar 16 | Open5GS CCA smf_s6b_sta_cb denial of service Affected: 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; 2.7.5; +1 more |
| CVE-2026-2524 | 7.5 | Feb 16 | Open5GS MME mme_s11_handle_create_session_response denial of service Affected: 2.7.6 |
| CVE-2026-2523 | 7.5 | Feb 16 | Open5GS SMF gn-handler.c smf_gn_handle_create_pdp_context_request assertion Affected: 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; 2.7.5; +1 more |
| CVE-2026-2517 | 7.5 | Feb 15 | Open5GS SMF types.c ogs_gtp2_parse_tft denial of service Affected: 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; 2.7.5; +1 more |
| CVE-2026-2062 | 7.5 | Feb 6 | Open5GS PGW S5U Address sgwc_sxa_handle_session_modification_response null pointer dereference Affected: 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; 2.7.5; +1 more |
| CVE-2026-1587 | 7.5 | Jan 29 | Open5GS SGWC s11-handler.c sgwc_s11_handle_modify_bearer_request denial of service Affected: 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; 2.7.5; +1 more |
| CVE-2026-1586 | 7.5 | Jan 29 | Open5GS SGWC s11-handler.c ogs_gtp2_f_teid_to_ip denial of service Affected: 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; 2.7.5 |
| CVE-2026-1522 | 7.5 | Jan 28 | Open5GS SGWC s5c-handler.c sgwc_s5c_handle_modify_bearer_response denial of service Affected: 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; 2.7.5; +1 more |
| CVE-2026-1521 | 7.5 | Jan 28 | Open5GS SGWC s5c-handler.c denial of service Affected: 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; 2.7.5; +1 more |
| CVE-2025-15539 | 7.5 | Jan 18 | Open5GS sgwc s11-handler.c sgwc_s11_handle_downlink_data_notification_ack denial of service Affected: 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; 2.7.5; +1 more |
| CVE-2025-15532 | 7.5 | Jan 17 | Open5GS Timer resource consumption Affected: 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; 2.7.5 |
| CVE-2025-15530 | 7.5 | Jan 17 | Open5GS s11-handler.c assertion Affected: 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; 2.7.5; +1 more |
| CVE-2025-15529 | 7.5 | Jan 16 | Open5GS s5c-handler.c sgwc_s5c_handle_create_session_response denial of service Affected: 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; 2.7.5; +1 more |
| CVE-2025-15528 | 7.5 | Jan 16 | Open5GS GTPv2 Bearer Response denial of service Affected: 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; 2.7.5; +1 more |
| CVE-2025-15176 | 7.5 | Dec 29 | Open5GS PFCP Session Establishment Request rule-match.c ogs_pfcp_pdr_rule_find_by_packet assertion Affected: 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; 2.7.5 |
| CVE-2025-65559 | 7.5 | Dec 18 | An issue was discovered in Open5GS 2.7.5-49-g465e90f, when processing a PFCP Session Establishment Request (type=50), the UPF crashes with a reachable assertion in… Affected: 2.7.5 |
| CVE-2025-63288 | 7.5 | Nov 10 | In Open5GS 2.7.6, AMF crashes when receiving an abnormal NGSetupRequest message, resulting in denial of service Affected: 2.7.6 |
| CVE-2025-41068 | 7.5 | Oct 27 | Reachable Assertion vulnerability in Open5GS Affected: before 2.7.5 |
| CVE-2025-41067 | 7.5 | Oct 27 | Reachable Assertion vulnerability in Open5GS Affected: before 2.7.5 |
| CVE-2025-52322 | 7.5 | Sep 9 | An issue in Open5GS v2.7.2 and before allows a remote attacker to cause a denial of service via a crafted Create Session Request message to the SMF (PGW-C), using the IP address… Affected: through 2.7.2 |
| CVE-2025-52288 | 7.5 | Sep 8 | Assertion failure in function ngap_build_downlink_nas_transport in file src/amf/ngap-build.c, the Access and Mobility Management Function (AMF) component, in Open5GS thru 2.7.5… Affected: through 2.7.5 |
| CVE-2025-8805 | 7.5 | Aug 10 | A vulnerability was determined in Open5GS up to 2.7.5 Affected: before 2.7.6 |
| CVE-2025-8804 | 7.5 | Aug 10 | A vulnerability was found in Open5GS up to 2.7.5 Affected: before 2.7.6 |
| CVE-2025-8803 | 7.5 | Aug 10 | A vulnerability has been found in Open5GS up to 2.7.5 Affected: before 2.7.6 |
| CVE-2025-8802 | 7.5 | Aug 10 | A vulnerability was determined in Open5GS up to 2.7.5 Affected: before 2.7.6 |
| CVE-2025-8801 | 7.5 | Aug 10 | A vulnerability was found in Open5GS up to 2.7.5 Affected: before 2.7.6 |
| CVE-2025-8800 | 7.5 | Aug 10 | A vulnerability has been found in Open5GS up to 2.7.5 Affected: before 2.7.6 |