OP
Vendor
open5gs
202
CVEs
0
On KEV
6
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-116544 New | OP open5gs open5gs | 3.7 | Oct 26 | Open5GS 2.6.1 through 2.8.0 Out-of-Bounds Read via parse_scheme_output |
| CVE-2026-116543 New | OP open5gs open5gs | 7.5 | Oct 26 | Open5GS 1.3.0 through 2.8.0 Heap Out-of-Bounds Write via SBI Multipart Parser |
| CVE-2026-108105 | OP open5gs open5gs | 5.9 | Oct 9 | Open5GS through 2.8.0 MME Reachable Assertion via GTPv1 SGSN Context Request |
| CVE-2026-108103 | OP open5gs open5gs | 5.3 | Oct 9 | Open5GS through 2.8.0 Heap Out-of-Bounds Read via PFCP Dropped DL Traffic Threshold IE |
| CVE-2026-108102 | OP open5gs open5gs | 5.3 | Oct 9 | Open5GS through 2.8.0 Heap Out-of-Bounds Read via PFCP Volume Measurement IE |
| CVE-2026-107166 | OP Open5GS Open5gs | 5.3 | Oct 7 | Open5GS GTP-U Receive Path gtp-path.c ogs_pfcp_xact_local_create allocation of resources |
| CVE-2026-92417 | OP Open5GS Open5gs | 6.5 | Sep 16 | Open5GS PFCP types.c ogs_pfcp_parse_volume_measurement null pointer dereference |
| CVE-2026-92416 | OP Open5GS Open5gs | 4.3 | Sep 16 | Open5GS PFCP Session Report Request n4-handler.c smf_n4_handle_session_report_request assertion |
| CVE-2026-91855 | OP Open5GS Open5gs | 5.3 | Sep 15 | Open5GS PFCP Message handler.c denial of service |
| CVE-2026-90707 | OP Open5GS Open5gs | 8.3 | Sep 14 | Open5GS Old AMF Discovery Fallback nnrf-handler.c amf_nnrf_try_old_amf_discovery_fallback use after free |
| CVE-2026-86212 | OP Open5GS Open5gs | 4.3 | Sep 6 | Open5GS AMF/MME improper authorization |
| CVE-2026-82590 | OP Open5GS Open5gs | 4.3 | Aug 30 | Open5GS SMF nudm-handler.c smf_nudm_sdm_handle_get assertion |
| CVE-2026-82589 | OP Open5GS Open5gs | 4.3 | Aug 30 | Open5GS N1-N2 Message namf-handler.c amf_namf_comm_handle_n1_n2_message_transfer denial of service |
| CVE-2026-82588 | OP Open5GS Open5gs | 4.3 | Aug 30 | Open5GS Transfer Endpoint namf-handler.c null pointer dereference |
| CVE-2026-82587 | OP Open5GS Open5gs | 4.3 | Aug 30 | Open5GS AMF namf-handler.c amf_namf_comm_decode_ue_mm_context_list memory corruption |
| CVE-2026-78186 | OP Open5GS Open5gs | 4.3 | Aug 24 | Open5GS HSS hss-cx-path.c assertion |
| CVE-2026-78158 | OP Open5GS Open5gs | 6.3 | Aug 24 | Open5GS AMF UEContextReleaseRequest Path improper authorization |
| CVE-2026-78157 | OP Open5GS Open5gs | 7.4 | Aug 24 | Open5GS Rx AA-Request pcrf-rx-path.c pcrf_rx_aar_cb out-of-bounds |
| CVE-2026-78156 | OP Open5GS Open5gs | 7.4 | Aug 23 | Open5GS S6a Authentication-Information-Request hss-s6a-path.c hss_ogs_diam_s6a_air_cb heap-based overflow |
| CVE-2025-15687 | OP Open5GS Open5gs | 4.3 | Aug 12 | Open5GS SMF Diameter Gx Credit-Control-Answer smf_gx_cca_cb denial of service |
| CVE-2025-15686 | OP Open5GS Open5gs | 4.3 | Aug 12 | Open5GS HSS Service fd_msg_sess_get denial of service |
| CVE-2025-15685 | OP Open5GS Open5gs | 6.3 | Aug 12 | Open5GS freeDiameter memory corruption |
| CVE-2025-15684 | OP Open5GS Open5gs | 5.3 | Aug 12 | Open5GS CER init.c diam_log_func assertion |
| CVE-2024-14044 | OP Open5GS Open5gs | 6.3 | Aug 12 | Open5GS Diameter Rx pcrf-rx-path.c pcrf_rx_aar_cb buffer overflow |
| CVE-2024-14043 | OP Open5GS Open5gs | 6.3 | Aug 11 | Open5GS Diameter S6a mme-fd-path.c mme_s6a_subscription_data_from_avp heap-based overflow |
| CVE-2024-14042 | OP Open5GS Open5gs | 6.3 | Aug 11 | Open5GS Diameter S6a hss-s6a-path.c hss_ogs_diam_s6a_ulr_cb stack-based overflow |
| CVE-2026-15720 | OP open5gs open5gs | 8.6 | Jul 14 | Pre-auth heap out-of-bounds read in the AMF NAS 5GS mobile-identity handler |
| CVE-2026-15194 | OP Open5GS Open5gs | 3.3 | Jul 9 | Open5GS AMF context.c amf_context_final use after free |
| CVE-2026-14618 | OP Open5GS Open5gs | 4.3 | Jul 4 | Open5GS AMF nnrf-handler.c amf_nnrf_handle_nf_discover denial of service |
| CVE-2026-10565 | OP Open5GS Open5gs | 3.1 | Jun 2 | Open5GS NGAP Handover gmm-sm.c gmm_state_security_mode race condition |
| CVE-2026-10157 | OP Open5GS Open5gs | 7.3 | May 31 | Open5GS NGAP PathSwitchRequest Message ngap-handler.c improper authentication |
| CVE-2026-10156 | OP Open5GS Open5gs | 4.3 | May 30 | Open5GS nf-instances Endpoint nnrf-handler.c handle_amf_info resource consumption |
| CVE-2026-10117 | OP Open5GS Open5gs | 4.3 | May 30 | Open5GS nghttp2-server.c ogs_pool_id_calloc denial of service |
| CVE-2026-10116 | OP Open5GS Open5gs | 4.3 | May 30 | Open5GS ue-authentications Endpoint ogs-timer.c ogs_sbi_xact_add denial of service |
| CVE-2026-10115 | OP Open5GS Open5gs | 4.3 | May 30 | Open5GS Shared NF-profile nnrf-handler.c denial of service |
| CVE-2026-10114 | OP Open5GS Open5gs | 4.3 | May 30 | Open5GS Shared NF-profile nnrf-handler.c handle_scp_info out-of-bounds write |
| CVE-2026-10113 | OP Open5GS Open5gs | 4.3 | May 30 | Open5GS Shared NF-profile nnrf-handler.c denial of service |
| CVE-2026-8746 | OP Open5GS Open5gs | 6.5 | May 17 | Open5GS NRF nghttp2-server.c discover_handler use after free |
| CVE-2026-8745 | OP Open5GS Open5gs | 6.5 | May 17 | Open5GS AUSF nausf-handler.c ogs_timer_add denial of service |
| CVE-2026-8744 | OP Open5GS Open5gs | 6.5 | May 17 | Open5GS NRF context.c ogs_sbi_nf_service_add denial of service |
| CVE-2026-8743 | OP Open5GS Open5gs | 6.3 | May 17 | Open5GS AMF/MME context.c ran_ue_find_by_amf_ue_ngap_id improper authorization |
| CVE-2026-8731 | OP Open5GS Open5gs | 6.5 | May 17 | Open5GS NRF client.c ogs_sbi_client_add denial of service |
| CVE-2026-8730 | OP Open5GS Open5gs | 6.5 | May 17 | Open5GS NRF context.c ogs_sbi_nf_instance_set_id denial of service |
| CVE-2026-8729 | OP Open5GS Open5gs | 6.5 | May 17 | Open5GS NRF message.c denial of service |
| CVE-2026-8728 | OP Open5GS Open5gs | 6.5 | May 17 | Open5GS NRF conv.c ogs_sbi_discovery_option_parse_plmn_list denial of service |
| CVE-2026-8292 | OP Open5GS Open5gs | 6.5 | May 11 | Open5GS NRF conv.c yuarel_parse denial of service |
| CVE-2026-8291 | OP Open5GS Open5gs | 6.5 | May 11 | Open5GS NRF nnrf-handler.c ogs_nnrf_nfm_handle_nf_profile denial of service |
| CVE-2026-8290 | OP Open5GS Open5gs | 6.5 | May 11 | Open5GS SMF nsmf-handler.c smf_nsmf_handle_update_data_in_vsmf denial of service |
| CVE-2026-8289 | OP Open5GS Open5gs | 6.5 | May 11 | Open5GS SMF nsmf-handler.c smf_nsmf_handle_update_data_in_vsmf denial of service |
| CVE-2026-8288 | OP Open5GS Open5gs | 6.5 | May 11 | Open5GS SMF gsm-handler.c denial of service |
| CVE-2026-8270 | OP Open5GS Open5gs | 6.5 | May 11 | Open5GS SMF ogs_nas_parse_qos_rules denial of service |
| CVE-2026-8269 | OP Open5GS Open5gs | 6.5 | May 11 | Open5GS SMF smf_nsmf_handle_create_sm_context denial of service |
| CVE-2026-8268 | OP Open5GS Open5gs | 6.5 | May 11 | Open5GS SMF OpenAPI_list_create denial of service |
| CVE-2026-8267 | OP Open5GS Open5gs | 6.5 | May 11 | Open5GS SMF smf_nsmf_handle_created_data_in_vsmf denial of service |
| CVE-2026-8266 | OP Open5GS Open5gs | 6.5 | May 11 | Open5GS SMF gsm-build.c gsm_build_pdu_session_establishment_accept denial of service |
| CVE-2026-8252 | OP Open5GS Open5gs | 6.5 | May 10 | Open5GS SMF smf_nsmf_handle_create_data_in_hsmf null pointer dereference |
| CVE-2026-8251 | OP Open5GS Open5gs | 6.5 | May 10 | Open5GS SMF npcf-handler.c update_authorized_pcc_rule_and_qos denial of service |
| CVE-2026-8250 | OP Open5GS Open5gs | 6.5 | May 10 | Open5GS SMF n4-build.c smf_n4_build_qos_flow_to_modify_list denial of service |
| CVE-2026-8249 | OP Open5GS Open5gs | 6.5 | May 10 | Open5GS SMF npcf-handler.c update_authorized_pcc_rule_and_qos denial of service |
| CVE-2026-8248 | OP Open5GS Open5gs | 6.5 | May 10 | Open5GS SMF npcf-handler.c update_authorized_pcc_rule_and_qos denial of service |
