OP
Product
open5gs
202
CVEs
0
On KEV
9.8
Max CVSS
6
New 30D
Severity mix
Critical 5High 87Medium 103Low 7
Watch
Add open5gs to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-107166 | 5.3 | Oct 7 | Open5GS GTP-U Receive Path gtp-path.c ogs_pfcp_xact_local_create allocation of resources Affected: 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; 2.7.5; +2 more |
| CVE-2026-91855 | 5.3 | Sep 15 | Open5GS PFCP Message handler.c denial of service Affected: 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; 2.7.5; +2 more |
| CVE-2025-15684 | 5.3 | Aug 12 | Open5GS CER init.c diam_log_func assertion Affected: 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; 2.7.5; +1 more |
| CVE-2026-7536 | 5.3 | May 1 | Open5GS BSF pcfBindings bsf_sess_add_by_ip_address denial of service Affected: 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; 2.7.5; +2 more |
| CVE-2026-1738 | 5.3 | Feb 2 | Open5GS SGWC context.c sgwc_tunnel_add assertion Affected: 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; 2.7.5; +1 more |
| CVE-2026-1737 | 5.3 | Feb 2 | Open5GS CreateBearerRequest s5c-handler.c sgwc_s5c_handle_create_bearer_request assertion Affected: 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; 2.7.5; +1 more |
| CVE-2026-1736 | 5.3 | Feb 2 | Open5GS SGWC s11-handler.c assertion Affected: 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; 2.7.5; +1 more |
| CVE-2025-15531 | 5.3 | Jan 17 | Open5GS context.c sgwc_bearer_add assertion Affected: 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; 2.7.5 |
| CVE-2025-14953 | 5.3 | Dec 19 | Open5GS FAR-ID handler.c ogs_pfcp_handle_create_pdr null pointer dereference Affected: 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; 2.7.5 |
| CVE-2025-9405 | 5.3 | Aug 25 | Open5GS gmm-sm.c gmm_state_exception assertion Affected: before 2.7.6 |
| CVE-2025-5520 | 5.3 | Jun 3 | Open5GS AMF/MME emm_state_authentication assertion Affected: 2.7.0 through 2.7.3 |
| CVE-2025-5501 | 5.3 | Jun 3 | Open5GS NGAP PathSwitchRequest Message ngap-handler.c ngap_handle_path_switch_request_transfer assertion Affected: through 2.7.3 |
| CVE-2024-24432 | 5.3 | Jan 22 | A reachable assertion in the ogs_kdf_hash_mme function of Open5GS <= 2.6.4 allows attackers to cause a Denial of Service (DoS) via a crafted NAS packet Affected: through 2.6.4 |
| CVE-2023-37012 | 5.3 | Jan 22 | Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface Affected: through 2.6.4 |
| CVE-2023-37008 | 5.3 | Jan 22 | Open5GS MME versions <= 2.6.4 contain a buffer overflow in the ASN.1 deserialization function of the S1AP handler Affected: through 2.6.4 |
| CVE-2023-37007 | 5.3 | Jan 22 | Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface Affected: through 2.6.4 |
| CVE-2023-37006 | 5.3 | Jan 22 | Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface Affected: through 2.6.4 |
| CVE-2023-37005 | 5.3 | Jan 22 | Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface Affected: through 2.6.4 |
| CVE-2023-37004 | 5.3 | Jan 22 | Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface Affected: through 2.6.4 |
| CVE-2023-37003 | 5.3 | Jan 22 | Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface Affected: through 2.6.4 |
| CVE-2023-37002 | 5.3 | Jan 22 | Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface Affected: through 2.6.4 |
| CVE-2024-33382 | 5.3 | May 8 | An issue in Open5GS v.2.7.0 allows an attacker to cause a denial of service via the 64 unsuccessful UE/gnb registration Affected: 2.7.0 |
| CVE-2024-34476 | 5.3 | May 5 | Open5GS before 2.7.1 is vulnerable to a reachable assertion that can cause an AMF crash via NAS messages from a UE: ogs_nas_encrypt in lib/nas/common/security.c for pkbuf->len Affected: before 2.7.1 |
| CVE-2026-92416 | 4.3 | Sep 16 | Open5GS PFCP Session Report Request n4-handler.c smf_n4_handle_session_report_request assertion Affected: 2.0; 2.1; 2.2; 2.3; 2.4; 2.5; +3 more |
| CVE-2026-86212 | 4.3 | Sep 6 | Open5GS AMF/MME improper authorization Affected: 2.7.7; 2.8.0 |
| CVE-2026-82590 | 4.3 | Aug 30 | Open5GS SMF nudm-handler.c smf_nudm_sdm_handle_get assertion Affected: 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; 2.7.5; +2 more |
| CVE-2026-82589 | 4.3 | Aug 30 | Open5GS N1-N2 Message namf-handler.c amf_namf_comm_handle_n1_n2_message_transfer denial of service Affected: 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; 2.7.5; +2 more |
| CVE-2026-82588 | 4.3 | Aug 30 | Open5GS Transfer Endpoint namf-handler.c null pointer dereference Affected: 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; 2.7.5; +2 more |
| CVE-2026-82587 | 4.3 | Aug 30 | Open5GS AMF namf-handler.c amf_namf_comm_decode_ue_mm_context_list memory corruption Affected: 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; 2.7.5; +2 more |
| CVE-2026-78186 | 4.3 | Aug 24 | Open5GS HSS hss-cx-path.c assertion Affected: 2.0; 2.1; 2.2; 2.3; 2.4; 2.5; +3 more |
| CVE-2025-15687 | 4.3 | Aug 12 | Open5GS SMF Diameter Gx Credit-Control-Answer smf_gx_cca_cb denial of service Affected: 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; 2.7.5; +1 more |
| CVE-2025-15686 | 4.3 | Aug 12 | Open5GS HSS Service fd_msg_sess_get denial of service Affected: 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; 2.7.5; +1 more |
| CVE-2026-14618 | 4.3 | Jul 4 | Open5GS AMF nnrf-handler.c amf_nnrf_handle_nf_discover denial of service Affected: 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; 2.7.5; +2 more |
| CVE-2026-10156 | 4.3 | May 30 | Open5GS nf-instances Endpoint nnrf-handler.c handle_amf_info resource consumption Affected: 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; 2.7.5; +2 more |
| CVE-2026-10117 | 4.3 | May 30 | Open5GS nghttp2-server.c ogs_pool_id_calloc denial of service Affected: 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; 2.7.5; +2 more |
| CVE-2026-10116 | 4.3 | May 30 | Open5GS ue-authentications Endpoint ogs-timer.c ogs_sbi_xact_add denial of service Affected: 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; 2.7.5; +2 more |
| CVE-2026-10115 | 4.3 | May 30 | Open5GS Shared NF-profile nnrf-handler.c denial of service Affected: 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; 2.7.5; +2 more |
| CVE-2026-10114 | 4.3 | May 30 | Open5GS Shared NF-profile nnrf-handler.c handle_scp_info out-of-bounds write Affected: 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; 2.7.5; +2 more |
| CVE-2026-10113 | 4.3 | May 30 | Open5GS Shared NF-profile nnrf-handler.c denial of service Affected: 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; 2.7.5; +2 more |
| CVE-2026-7781 | 4.3 | May 4 | Open5GS amf-3gpp-access Endpoint nudm-handler.c udm_nudm_uecm_handle_amf_registration_update denial of service Affected: 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; 2.7.5; +2 more |
| CVE-2026-7780 | 4.3 | May 4 | Open5GS smf-registrations Endpoint udm-sm.c udm_state_operational denial of service Affected: 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; 2.7.5; +2 more |
| CVE-2026-7779 | 4.3 | May 4 | Open5GS authentication-subscription Endpoint nudr-handler.c udm_nudr_dr_handle_subscription_authentication denial of service Affected: 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; 2.7.5; +2 more |
| CVE-2026-7708 | 4.3 | May 3 | Open5GS UDR subscription.c ogs_dbi_subscription_data denial of service Affected: 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; 2.7.5; +2 more |
| CVE-2026-7707 | 4.3 | May 3 | Open5GS UDR nudr-handler.c udr_nudr_dr_handle_subscription_context denial of service Affected: 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; 2.7.5; +2 more |
| CVE-2026-7706 | 4.3 | May 3 | Open5GS AMF gmm-handler.c gmm_handle_service_request denial of service Affected: 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; 2.7.5; +2 more |
| CVE-2026-7601 | 4.3 | May 2 | Open5GS AMF gmm-handler.c denial of service Affected: 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; 2.7.5; +1 more |
| CVE-2026-7587 | 4.3 | May 1 | Open5GS AMF nsmf-handler.c amf_nsmf_pdusession_handle_update_sm_context denial of service Affected: 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; 2.7.5; +2 more |
| CVE-2026-7586 | 4.3 | May 1 | Open5GS AMF nudm-handler.c ogs_id_get_value denial of service Affected: 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; 2.7.5; +2 more |
| CVE-2026-7585 | 4.3 | May 1 | Open5GS AMF nudm-handler.c amf_nudm_sdm_handle_provisioned denial of service Affected: 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; 2.7.5; +2 more |
| CVE-2026-7583 | 4.3 | May 1 | Open5GS BSF context.c bsf_sess_find_by_ipv6prefix denial of service Affected: 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; 2.7.5; +2 more |