free5gc vulnerabilities
CVEs whose affected-version data names the free5gc package (go). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
24 CVEsRSS
CVE-2026-94043Medium· 5.3PoCA vulnerability was determined in Free5GC up to 4.2.3
A vulnerability was determined in Free5GC up to 4.2.3. This vulnerability affects unknown code of the file /corefuzzer_deps/free5gc/NFs/amf/internal/gmm/handler.go of the component Gmm Handler. This manipulation causes race condition. Th…
CVE-2026-47780Medium· 6.9PoCfree5GC is an open-source implementation of the 5G core network
free5GC is an open-source implementation of the 5G core network. In 4.2.3 and earlier, HandleCreateEeSubscriptions and HandleQueryeesubscriptions in free5gc/udr internal/sbi/api_datarepository.go validate the ueId path value with a regul…
CVE-2026-44330Critical· 10.0free5GC is an open-source implementation of the 5G core network
free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's NEF mounts the nnef-pfdmanagement route group without inbound OAuth2/bearer-token authorization. A network attacker who can reach NEF on the SBI c…
CVE-2026-44329Critical· 10.0free5GC is an open-source implementation of the 5G core network
free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's SMF mounts the UPI management route group without OAuth2/bearer-token authorization middleware. A network attacker who can reach SMF on the SBI ca…
CVE-2026-44328High· 8.2free5GC is an open-source implementation of the 5G core network
free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's SMF mounts the UPI management route group without inbound OAuth2 middleware. On top of that, the DELETE /upi/v1/upNodesLinks/{upNodeRef} handler u…
CVE-2026-44326Critical· 9.4free5GC is an open-source implementation of the 5G core network
free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's NEF mounts the 3gpp-traffic-influence API without inbound OAuth2/bearer-token authorization. A network attacker who can reach NEF on the SBI can c…
CVE-2026-44325High· 7.5free5GC is an open-source implementation of the 5G core network
free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's NRF root SBI endpoint POST /oauth2/token contains a parser-level type-confusion bug family. The handler in NFs/nrf/internal/sbi/api_accesstoken.go…
CVE-2026-44324Medium· 6.5free5GC is an open-source implementation of the 5G core network
free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's UDR nudr-dr DELETE /subscription-data/{ueId}/{servingPlmnId}/ee-subscriptions/{subsId}/amf-subscriptions handler panics on a single authenticated …
CVE-2026-44323Medium· 4.3free5GC is an open-source implementation of the 5G core network
free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's UDR nudr-dr DELETE /subscription-data/{ueId}/{servingPlmnId}/ee-subscriptions/{subsId}/amf-subscriptions handler contains a nil-pointer dereferenc…
CVE-2026-44322High· 7.5free5GC is an open-source implementation of the 5G core network
free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's NEF PATCH /3gpp-pfd-management/v1/{afId}/transactions/{transId}/applications/{appId} handler panics with a nil-pointer dereference when the upstre…
CVE-2026-44321High· 7.5free5GC is an open-source implementation of the 5G core network
free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's SMF mounts the UPI management route group without inbound OAuth2 middleware. The POST /upi/v1/upNodesLinks create-or-update handler accepts attack…
CVE-2026-44320High· 7.3free5GC is an open-source implementation of the 5G core network
free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's NEF mounts the nnef-callback route group without inbound OAuth2/bearer-token authorization. A forged or arbitrary bearer token (e.g. Authorization…
CVE-2026-44319High· 7.5free5GC is an open-source implementation of the 5G core network
free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's NEF terminates the entire process when a stored PFD-subscription notifyUri cannot be reached. In PfdChangeNotifier.FlushNotifications(), the notif…
CVE-2026-44318Medium· 6.5free5GC is an open-source implementation of the 5G core network
free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's BSF PUT /nbsf-management/v1/subscriptions/{subId} handler has an unsynchronized write on the global Subscriptions map. The handler first reads the…
CVE-2026-44317Medium· 6.5free5GC is an open-source implementation of the 5G core network
free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's PCF POST /npcf-policyauthorization/v1/app-sessions handler panics on a single authenticated request whose ascReqData.suppFeat == "1" (enabling tra…
CVE-2026-44316High· 7.5free5GC is an open-source implementation of the 5G core network
free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's PCF POST /npcf-smpolicycontrol/v1/sm-policies handler (HandleCreateSmPolicyRequest) panics with a nil-pointer dereference when a downstream OpenAP…
CVE-2026-44315Critical· 9.4free5GC is an open-source implementation of the 5G core network
free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's NEF mounts the 3gpp-pfd-management API without inbound OAuth2/bearer-token authorization. A network attacker who can reach NEF on the SBI can crea…
CVE-2026-42459High· 7.5free5GC is an open-source implementation of the 5G core network
free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, the free5GC UDM component fails to validate the supi path parameter in six GET handlers of the nudm-sdm (Subscriber Data Management) service. An unauthentic…
CVE-2026-42083High· 8.2free5GC is an open-source implementation of the 5G core network
free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, PCF Npcf_SMPolicyControl missing authentication middleware allows unauthenticated access to SM policy handlers and disclosure of subscriber SUPI. In NewServ…
CVE-2026-42082Low· 3.7free5GC is an open-source implementation of the 5G core network
free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, the AMF in Free5GC does not enforce the concurrent security procedure rules defined in 3GPP TS 33.501 §6.9.5.1. The AMF does not check for ongoing N2 handov…
CVE-2026-42081Medium· 6.1free5GC is an open-source implementation of the 5G core network
free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, the AMF in Free5GC does not verify the UE Security Capabilities received in NGAP PathSwitchRequest messages against its locally stored values, as mandated b…
CVE-2026-44327Critical· 10.0free5GC is an open-source implementation of the 5G core network
free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's NEF mounts the nnef-oam route group without inbound OAuth2/bearer-token authorization. A network attacker who can reach NEF on the SBI can hit the…
CVE-2025-65562High· 7.5The free5GC UPF suffers from a lack of bounds checking on the SEID when processing PFCP Session Deletion Requests
The free5GC UPF suffers from a lack of bounds checking on the SEID when processing PFCP Session Deletion Requests. An unauthenticated remote attacker can send a request with a very large SEID (e.g., 0xFFFFFFFFFFFFFFFF) that causes an int…
CVE-2025-65561High· 7.5An issue was discovered in function LocalNode.Sess in free5GC 4.1.0 allowing attackers to cause a denial of service or other unspecified impacts via crafted header Local SEID to the PFCP Session Modification Request.
An issue was discovered in function LocalNode.Sess in free5GC 4.1.0 allowing attackers to cause a denial of service or other unspecified impacts via crafted header Local SEID to the PFCP Session Modification Request.