Log in Start free

Open5GS

Products

ProductCVEsExploitedLatest
Open5GS12–Oct 26, 2026

Exploited and recent CVEs

  • CVE-2026-116544 Low 3.7 Open5GS 2.6.1 through 2.8.0 Out-of-Bounds Read via parse_scheme_output 0.4%
  • CVE-2026-116543 High 7.5 Open5GS 1.3.0 through 2.8.0 Heap Out-of-Bounds Write via SBI Multipart Parser 0.4%
  • CVE-2026-108105 Medium 5.9 Open5GS through 2.8.0 MME Reachable Assertion via GTPv1 SGSN Context Request 0.5%
  • CVE-2026-108103 Medium 5.3 Open5GS through 2.8.0 Heap Out-of-Bounds Read via PFCP Dropped DL Traffic Threshold IE 0.4%
  • CVE-2026-108102 Medium 5.3 Open5GS through 2.8.0 Heap Out-of-Bounds Read via PFCP Volume Measurement IE 0.4%
  • CVE-2026-15720 High 8.6 Pre-auth heap out-of-bounds read in the AMF NAS 5GS mobile-identity handler 0.5%
  • CVE-2023-4885 Medium 6.5 Multiple vulnerabilities in Open5GS 0.3%
  • CVE-2023-4884 Medium 6.5 Multiple vulnerabilities in Open5GS 0.5%
  • CVE-2023-4883 High 7.5 Multiple vulnerabilities in Open5GS 0.6%
  • CVE-2023-4882 High 7.5 Multiple vulnerabilities in Open5GS 0.6%
  • CVE-2023-23846 High 7.5 Due to insufficient length validation in the Open5GS GTP library versions prior to versions 2.4.13 and 2.5.7, when parsing extension headers in GPRS tunneling protocol (GPTv1-U) messages, a protocol p 0.8%
  • CVE-2022-39063 Unrated When Open5GS UPF receives a PFCP Session Establishment Request, it stores related values for building the PFCP Session Establishment Response. Once UPF receives a request, it gets the f_teid_len from 1.2%