A vulnerability was found in Open5GS up to 2.7.5

A vulnerability has been found in Open5GS up to 2.7.5

A vulnerability was determined in Open5GS up to 2.7.5

A vulnerability was found in Open5GS up to 2.7.5

A vulnerability has been found in Open5GS up to 2.7.5

A vulnerability was identified in Open5GS up to 2.7.5

A vulnerability was found in Open5GS up to 2.7.3

An issue in UPF in Open5GS UPF versions up to v2.7.2 results an assertion failure vulnerability in PFCP session parameter validation

A vulnerability classified as problematic was found in Open5GS up to 2.7.2

A vulnerability was found in Open5GS up to 2.7.2

An issue was discovered in Open5gs v2.7.2

An issue in Open5GS v.2.7.2 allows a remote attacker to cause a denial of service via the ogs_dbi_auth_info function in lib/dbi/subscription.c file

A reachable assertion in the mme_ue_find_by_imsi function of Open5GS <= 2.6.4 allows attackers to cause a Denial of Service (DoS) via a crafted NAS packet

Open5GS MME versions <= 2.6.4 contain a reachable assertion in the `UE Context Release Request` packet handler

Open5GS MME versions <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface

A reachable assertion in the oai_nas_5gmm_decode function of Open5GS <= 2.6.4 allows attackers to cause a Denial of Service (DoS) via a crafted NGAP packet

A reachable assertion in the amf_ue_set_suci function of Open5GS <= 2.6.4 allows attackers to cause a Denial of Service (DoS) via a crafted NAS packet

A reachable assertion in the ogs_nas_emm_decode function of Open5GS v2.7.0 allows attackers to cause a Denial of Service (DoS) via a crafted NAS packet with a zero-length EMM…

An issue in Open 5GS v.2.7.1 allows a remote attacker to cause a denial of service via the Network Function Virtualizations (NFVs) such as the User Plane Function (UPF) and the…

Open5GS before 2.7.1 is vulnerable to a reachable assertion that can cause an AMF crash via NAS messages from a UE: gmm_state_authentication in amf/gmm-sm.c for != OGS_ERROR

An issue was discovered in open5gs v2.6.6

An attacker could send an HTTP request to an Open5GS endpoint and retrieve the information stored on the device due to the lack of Authentication

Invalid pointer release vulnerability

DOS vulnerability that could allow an attacker to register a new VNF (Virtual Network Function) value

Due to insufficient length validation in the Open5GS GTP library versions prior to versions 2.4.13 and 2.5.7, when parsing extension headers in GPRS tunneling protocol (GPTv1-U)…

open5gs v2.4.11 was discovered to contain a memory leak in the component ngap-handler.c

open5gs v2.4.11 was discovered to contain a memory leak in the component src/upf/pfcp-path.c

open5gs v2.4.11 was discovered to contain a memory leak in the component src/smf/pfcp-path.c

A vulnerability in /src/amf/amf-context.c in Open5GS 2.4.10 and earlier leads to AMF denial of service

A vulnerability has been found in Open5GS up to 2.4.10 and classified as problematic

When Open5GS UPF receives a PFCP Session Establishment Request, it stores related values for building the PFCP Session Establishment Response

A buffer overflow in lib/sbi/message.c in Open5GS 2.3.6 and earlier allows remote attackers to Denial of Service via a crafted sbi request

A null pointer dereference in src/amf/namf-handler.c in Open5GS 2.3.6 and earlier allows remote attackers to Denial of Service via a crafted sbi request to amf

A buffer overflow vulnerability exists in the AMF of open5gs 2.1.4

In Open5GS 2.4.0, a crafted packet from UE can crash SGW-U/UPF

ogs_fqdn_parse in Open5GS 1.0.0 through 2.3.3 inappropriately trusts a client-supplied length value, leading to a buffer overflow

Open5GS Rx AA-Request pcrf-rx-path.c pcrf_rx_aar_cb out-of-bounds

Open5GS S6a Authentication-Information-Request hss-s6a-path.c hss_ogs_diam_s6a_air_cb heap-based overflow

Open5GS NGAP PathSwitchRequest Message ngap-handler.c improper authentication

Open5GS MME versions <= 2.6.4 contains an assertion that can be remotely triggered via a sufficiently large ASN.1 packet over the S1AP interface

An issue in upf in open5gs 2.7.2 and earlier allows a remote attacker to cause a Denial of Service via a crafted PFCP SessionEstablishmentRequest packet with restoration…

A missing length check in `ogs_pfcp_dev_add` function from PFCP library, used by both smf and upf in open5gs 2.7.2 and earlier, allows a local attacker to cause a Buffer Overflow…

Open5GS PFCP types.c ogs_pfcp_parse_volume_measurement null pointer dereference

Open5GS NRF nghttp2-server.c discover_handler use after free

Open5GS AUSF nausf-handler.c ogs_timer_add denial of service

Open5GS NRF context.c ogs_sbi_nf_service_add denial of service

Open5GS NRF client.c ogs_sbi_client_add denial of service

Open5GS NRF context.c ogs_sbi_nf_instance_set_id denial of service

Open5GS NRF message.c denial of service

Open5GS NRF conv.c ogs_sbi_discovery_option_parse_plmn_list denial of service