FR
Vendor
free5gc
108
CVEs
0
On KEV
0
New 30D
Products
FR10.0
free5gc
free5gc
72 CVEs0 on KEV0 new
UD8.6
udm
free5gc
9 CVEs0 on KEV0 new
SM7.5
smf
free5gc
8 CVEs0 on KEV0 new
UD5.8
udr
free5gc
4 CVEs0 on KEV0 new
PC7.5
pcf
free5gc
3 CVEs0 on KEV0 new
AM7.5
amf
free5gc
2 CVEs0 on KEV0 new
AU7.5
ausf
free5gc
2 CVEs0 on KEV0 new
GO7.5
go-upf
free5gc
2 CVEs0 on KEV0 new
NR9.1
nrf
free5gc
2 CVEs0 on KEV0 new
WE9.8
Webconsole
Free5gc
2 CVEs0 on KEV0 new
CH6.5
chf
free5gc
1 CVEs0 on KEV0 new
UP7.5
Upf
Free5gc
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-94043 | FR Free5GC Free5gc | 5.3 | Sep 20 | Free5GC Gmm handler.go race condition |
| CVE-2026-47780 | FR free5gc free5gc | 6.9 | Sep 15 | free5GC: UDR Improper ueId validation in free5GC EE subscription handlers allows arbitrary identifier persistence |
| CVE-2026-55785 | FR free5gc free5gc | 3.7 | Aug 28 | free5GC AUSF uses non-constant-time authentication comparisons and logs XRES* in 5G-AKA |
| CVE-2026-55784 | FR free5gc free5gc | 7.5 | Aug 28 | free5GC AUSF authentication contexts can be overwritten by concurrent requests for the same SUPI |
| CVE-2026-55068 | FR free5gc free5gc | 9.3 | Aug 28 | free5GC: NRF nnrf-nfm lacks NF Profile input validation — enables NF Registration Poisoning with arbitrary service endpoints |
| CVE-2026-53551 | FR free5gc free5gc | 6.9 | Jul 31 | free5GC AUSF: null byte injection in supiOrSuci causes HTTP 500 internal service failure |
| CVE-2026-42081 | FR free5gc free5gc | 7.1 | May 27 | free5GC: UE Security Capability bypass on NGAP PathSwitchRequest |
| CVE-2026-42082 | FR free5gc free5gc | 5.4 | May 27 | free5GC: Missing Concurrent NAS SMC Validation During NGAP Handover |
| CVE-2026-42083 | FR free5gc free5gc | 8.2 | May 27 | free5GC: PCF Npcf_SMPolicyControl missing authentication middleware allows unauthenticated access to SM policy handlers and disclosure of subscriber SUPI |
| CVE-2026-42459 | FR free5gc free5gc | 7.5 | May 27 | free5GC: Improper Input Validation and Generation of Error Message Containing Sensitive Information in github.com/free5gc/udm |
| CVE-2026-44315 | FR free5gc free5gc | 9.4 | May 27 | free5GC: NEF 3gpp-pfd-management API is unauthenticated; forged bearer tokens can create, read, and delete PFD transactions |
| CVE-2026-44316 | FR free5gc free5gc | 7.5 | May 27 | free5GC: PCF npcf-smpolicycontrol POST /sm-policies panics on downstream UDR/OpenAPI 404 via nil pointer dereference |
| CVE-2026-44317 | FR free5gc free5gc | 6.5 | May 27 | free5GC: PCF npcf-policyauthorization POST /app-sessions panics on suppFeat=1 with missing AfRoutReq via nil pointer dereference |
| CVE-2026-44319 | FR free5gc free5gc | 7.5 | May 27 | free5GC: NEF crashes via logger.Fatal on PFD notification delivery failure (attacker-controlled notifyUri) |
| CVE-2026-44320 | FR free5gc free5gc | 7.3 | May 27 | free5GC: NEF nnef-callback route group is unauthenticated; forged callback requests are accepted into the processing path |
| CVE-2026-44321 | FR free5gc free5gc | 7.5 | May 27 | free5GC: SMF UPI POST /upi/v1/upNodesLinks exits the SMF process on overlapping UE pools (unauthenticated, reachable Fatalf) |
| CVE-2026-44322 | FR free5gc free5gc | 7.5 | May 27 | free5GC: NEF 3gpp-pfd-management PATCH applications/{appId} panics on UDR access failure due to nil ProblemDetails dereference |
| CVE-2026-44323 | FR free5gc free5gc | 6.5 | May 27 | free5GC: UDR nudr-dr DELETE amf-subscriptions panics on missing subsId when UE state exists (nil pointer dereference) |
| CVE-2026-44324 | FR free5gc free5gc | 6.5 | May 27 | free5GC: UDR nudr-dr DELETE amf-subscriptions panics on missing UE state via nil interface type assertion (single authenticated request) |
| CVE-2026-44325 | FR free5gc free5gc | 7.5 | May 27 | free5GC: NRF POST /oauth2/token structured-form parser type-confusion panic family (Reflect.Set on incompatible types) |
| CVE-2026-44326 | FR free5gc free5gc | 9.4 | May 27 | free5GC: NEF 3gpp-traffic-influence API is unauthenticated; missing or forged bearer tokens can create, read, patch, and delete subscriptions |
| CVE-2026-44327 | FR free5gc free5gc | 10.0 | May 27 | free5GC: NEF nnef-oam route group is unauthenticated; no-token requests reach the OAM handler |
| CVE-2026-44328 | FR free5gc free5gc | 8.2 | May 27 | free5GC: SMF UPI DELETE /upi/v1/upNodesLinks/{ref} panics on AN-node deletion via nil UPF dereference; unauthenticated, state-mutating |
| CVE-2026-44329 | FR free5gc free5gc | 10.0 | May 27 | free5GC: SMF UPI management interface lacks auth middleware; unauthenticated topology read/write requests reach handlers |
| CVE-2026-44330 | FR free5gc free5gc | 10.0 | May 27 | free5GC: NEF nnef-pfdmanagement API is unauthenticated; forged bearer tokens can read PFD data and create/delete PFD subscriptions |
| CVE-2026-44318 | FR free5gc free5gc | 5.3 | May 27 | free5GC: BSF concurrent PUT /nbsf-management/v1/subscriptions/{subId} crashes the BSF process via concurrent map read/write on Subscriptions |
| CVE-2026-41136 | AM amf free5gc | 5.3 | Apr 21 | free5GC AMF missing default case in Content-Type switch in HTTPUEContextTransfer |
| CVE-2026-41135 | PC pcf free5gc | 7.5 | Apr 21 | free5GC PCF: Memory Leak via CORS Middleware Registration in HTTP Handler Leads to Denial of Service |
| CVE-2026-40343 | UD udr free5gc | 5.8 | Apr 21 | free5GC UDR: Fail-open handling in PolicyDataSubsToNotifyPost allows unintended subscription creation |
| CVE-2026-40249 | FR free5gc free5gc | 5.3 | Apr 16 | free5gc UDR fail-open request handling in PolicyDataSubsToNotifySubsIdPut may allow unintended subscription updates after input errors |
| CVE-2026-40248 | FR free5gc free5gc | 7.5 | Apr 16 | free5gc UDR improper path validation allows unauthenticated creation and modification of Traffic Influence Subscriptions |
| CVE-2026-40247 | FR free5gc free5gc | 7.5 | Apr 16 | free5gc UDR improper path validation allows unauthenticated access to Traffic Influence Subscriptions |
| CVE-2026-40246 | FR free5gc free5gc | 7.5 | Apr 16 | free5gc UDR improper path validation allows unauthenticated deletion of Traffic Influence Subscriptions |
| CVE-2026-40245 | FR free5gc free5gc | 7.5 | Apr 15 | Free5GC: UDR nudr-dr influenceData/subs-to-notify leaks SUPI in error response body without authentication |
| CVE-2026-5661 | FR Free5GC Free5gc | 5.3 | Apr 6 | Free5GC NGSetupRequest denial of service |
| CVE-2026-5360 | FR Free5GC Free5gc | 3.7 | Apr 2 | Free5GC aper type confusion |
| CVE-2026-30653 | FR Free5gc Free5gc | 7.5 | Mar 24 | An issue in Free5GC v.4.2.0 and before allows a remote attacker to cause a denial of service via the function HandleAuthenticationFailure of the component AMF |
| CVE-2026-4531 | FR Free5GC Free5gc | 5.3 | Mar 22 | Free5GC AMF handler.go HandleRegistrationComplete denial of service |
| CVE-2026-33192 | FR free5gc free5gc | 5.3 | Mar 20 | free5GC UDM incorrectly returns 500 for empty supi path parameter in PATCH sdm-subscriptions reques |
| CVE-2026-33065 | FR free5gc free5gc | 5.3 | Mar 20 | free5GC UDM incorrectly returns 500 for empty supi path parameter in DELETE sdm-subscriptions request |
| CVE-2026-33064 | FR free5gc free5gc | 7.5 | Mar 20 | free5GC UDM DataChangeNotification Procedure Panic Due to Nil Pointer Dereference |
| CVE-2026-33191 | FR free5gc free5gc | 8.6 | Mar 20 | free5GC UDM vulnerable to null byte injection in URL path parameters causing 500 Internal Server Error |
| CVE-2026-33063 | AU ausf free5gc | 7.5 | Mar 20 | free5GC AUSF UE Authentication Panic on Nil SuciSupiMap Interface Conversion |
| CVE-2026-33062 | NR nrf free5gc | 7.5 | Mar 20 | free5GC NRF Discovery EncodeGroupId Function Panics on Malformed group-id-list Parameter |
| CVE-2026-32937 | CH chf free5gc | 6.5 | Mar 20 | free5GC CHF has Out-of-Bounds Slice Access that Leads to DoS |
| CVE-2026-27643 | UD udr free5gc | 5.3 | Feb 24 | free5GC has improper error handling in NEF with information exposure |
| CVE-2026-27642 | UD udm free5gc | 7.5 | Feb 24 | free5GC has Improper Input Validation in UDM UEAU Service |
| CVE-2026-26025 | SM smf free5gc | 7.5 | Feb 24 | free5GC SMF crash (nil pointer dereference) on PFCP SessionReportRequest when ReportType.USAR=1 and UsageReport omits mandatory URRID sub-IE  |
| CVE-2026-26024 | SM smf free5gc | 7.5 | Feb 24 | free5GC SMF crash (nil pointer dereference) on PFCP SessionReportRequest when ReportType.USAR=1 and UsageReport omits mandatory URRID sub-IE  |
| CVE-2026-25501 | SM smf free5gc | 7.5 | Feb 24 | free5GC SMF crash (nil pointer dereference) on PFCP SessionReportRequest when ReportType.DLDR is set but DownlinkDataReport IE is missing |
| CVE-2025-69253 | UD udr free5gc | 5.3 | Feb 24 | free5GC vulnerable to improper error handling in NEF with information exposure |
| CVE-2025-69252 | UD udm free5gc | 7.5 | Feb 23 | free5GC has Null Pointer Dereference in UDM, Leading to Service Panic |
| CVE-2025-69251 | UD udm free5gc | 5.3 | Feb 23 | free5GC has Improper Input Validation in UDM, Leading to Information Exposure |
| CVE-2025-69250 | UD udm free5gc | 7.5 | Feb 23 | free5GC has Improper Error Handling in UDM, Leading to Information Exposure |
| CVE-2025-69248 | AM amf free5gc | 7.5 | Feb 23 | free5GC has Array Index Out of Bounds in AMF Leading to Denial of Service |
| CVE-2025-69247 | GO go-upf free5gc | 7.5 | Feb 23 | free5GC has Heap Buffer Overflow in UPF Leading to Denial of Service |
| CVE-2025-69232 | GO go-upf free5gc | 7.5 | Feb 23 | free5GC hasProtocol Compliance Violation in UPF Leading to SMF Service Disruption |
| CVE-2025-69208 | UD udr free5gc | 5.3 | Feb 23 | free5GC UDR's NEF incorrectly returns 500 for missing PFD data (UDR 404) in Nnef_PfdManagement GET request |
| CVE-2026-2525 | FR Free5GC Free5gc | 7.5 | Feb 16 | Free5GC PFCP UDP Endpoint denial of service |
| CVE-2025-70122 | FR Free5gc Free5gc | 7.5 | Feb 13 | A heap buffer overflow vulnerability in the UPF component of free5GC v4.0.1 allows remote attackers to cause a denial of service via a crafted PFCP Session Modification Request |