FFree5GC

Products

Exploited and recent CVEs

• CVE-2026-47780 Medium 6.9 free5GC: UDR Improper ueId validation in free5GC EE subscription handlers allows arbitrary identifier persistence 0.5%
• CVE-2026-55785 Low 3.7 free5GC AUSF uses non-constant-time authentication comparisons and logs XRES* in 5G-AKA 0.4%
• CVE-2026-55784 High 7.5 free5GC AUSF authentication contexts can be overwritten by concurrent requests for the same SUPI 0.4%
• CVE-2026-55068 Critical 9.3 free5GC: NRF nnrf-nfm lacks NF Profile input validation — enables NF Registration Poisoning with arbitrary service endpoints 0.6%
• CVE-2026-53551 Medium 6.9 free5GC AUSF: null byte injection in supiOrSuci causes HTTP 500 internal service failure 0.7%
• CVE-2026-53551 Medium 6.9 free5GC AUSF: null byte injection in supiOrSuci causes HTTP 500 internal service failure 0.7%
• CVE-2026-42081 Medium 6.1 free5GC: UE Security Capability bypass on NGAP PathSwitchRequest 0.3%
• CVE-2026-42082 Low 3.7 free5GC: Missing Concurrent NAS SMC Validation During NGAP Handover 0.3%
• CVE-2026-42083 High 8.2 free5GC: PCF Npcf_SMPolicyControl missing authentication middleware allows unauthenticated access to SM policy handlers and disclosure of subscriber SUPI 0.3%
• CVE-2026-42459 High 7.7 free5GC: Improper Input Validation and Generation of Error Message Containing Sensitive Information in github.com/free5gc/udm 0.3%
• CVE-2026-44315 Critical 9.4 free5GC: NEF 3gpp-pfd-management API is unauthenticated; forged bearer tokens can create, read, and delete PFD transactions 0.3%
• CVE-2026-44316 High 7.5 free5GC: PCF npcf-smpolicycontrol POST /sm-policies panics on downstream UDR/OpenAPI 404 via nil pointer dereference 0.4%
• CVE-2026-44317 Medium 6.5 free5GC: PCF npcf-policyauthorization POST /app-sessions panics on suppFeat=1 with missing AfRoutReq via nil pointer dereference 0.4%
• CVE-2026-44319 High 7.5 free5GC: NEF crashes via logger.Fatal on PFD notification delivery failure (attacker-controlled notifyUri) 0.4%
• CVE-2026-44320 High 7.3 free5GC: NEF nnef-callback route group is unauthenticated; forged callback requests are accepted into the processing path 0.2%
• CVE-2026-44321 High 7.5 free5GC: SMF UPI POST /upi/v1/upNodesLinks exits the SMF process on overlapping UE pools (unauthenticated, reachable Fatalf) 0.4%
• CVE-2026-44322 High 7.5 free5GC: NEF 3gpp-pfd-management PATCH applications/{appId} panics on UDR access failure due to nil ProblemDetails dereference 0.4%
• CVE-2026-44323 Medium 4.3 free5GC: UDR nudr-dr DELETE amf-subscriptions panics on missing subsId when UE state exists (nil pointer dereference) 0.4%
• CVE-2026-44324 Medium 6.5 free5GC: UDR nudr-dr DELETE amf-subscriptions panics on missing UE state via nil interface type assertion (single authenticated request) 0.4%
• CVE-2026-44325 High 7.5 free5GC: NRF POST /oauth2/token structured-form parser type-confusion panic family (Reflect.Set on incompatible types) 0.4%
• CVE-2026-44326 Critical 9.4 free5GC: NEF 3gpp-traffic-influence API is unauthenticated; missing or forged bearer tokens can create, read, patch, and delete subscriptions 0.3%
• CVE-2026-44327 Critical 10.0 free5GC: NEF nnef-oam route group is unauthenticated; no-token requests reach the OAM handler 0.3%
• CVE-2026-44328 High 8.2 free5GC: SMF UPI DELETE /upi/v1/upNodesLinks/{ref} panics on AN-node deletion via nil UPF dereference; unauthenticated, state-mutating 0.3%
• CVE-2026-44329 Critical 10.0 free5GC: SMF UPI management interface lacks auth middleware; unauthenticated topology read/write requests reach handlers 0.3%
• CVE-2026-44330 Critical 10.0 free5GC: NEF nnef-pfdmanagement API is unauthenticated; forged bearer tokens can read PFD data and create/delete PFD subscriptions 0.3%
• CVE-2026-44318 Medium 6.5 free5GC: BSF concurrent PUT /nbsf-management/v1/subscriptions/{subId} crashes the BSF process via concurrent map read/write on Subscriptions 0.3%
• CVE-2026-41136 Medium 5.5 free5GC AMF missing default case in Content-Type switch in HTTPUEContextTransfer 0.3%
• CVE-2026-41135 High 7.5 free5GC PCF: Memory Leak via CORS Middleware Registration in HTTP Handler Leads to Denial of Service 0.5%
• CVE-2026-40343 Medium 6.9 free5GC UDR: Fail-open handling in PolicyDataSubsToNotifyPost allows unintended subscription creation 8.6%
• CVE-2026-40249 Medium 6.9 free5gc UDR fail-open request handling in PolicyDataSubsToNotifySubsIdPut may allow unintended subscription updates after input errors 0.3%