- Latest release
- v1.4.6 (Sep 4, 2026): affected by CVE-2026-55784
- Newest unaffected release
- Every release is affected by at least one advisory
- Advisories
- 4 · 2 high, 1 medium, 1 low
- Releases
- 18 since v1.0.0 (Jan 30, 2021)
- Registry
- pkg.go.dev
- Releases read
- Nov 8, 2026
Version timeline
- CVE-2026-55785Affects v1.0.0 to v1.4.4 (v1.4.5 is outside it)
- CVE-2026-55784Affects v1.0.0 to v1.4.6 (through the newest release)
- CVE-2026-53551Affects v1.0.0 to v1.4.4 (v1.4.5 is outside it)
- CVE-2026-33063Affects v1.0.0 to v1.4.1 (v1.4.2 is outside it)
Advisories 4
- CVE-2026-55785Low 3.7
free5GC AUSF uses non-constant-time authentication comparisons and logs XRES in 5G-AKA
Affected: fixed in 1.4.5.
Fixed in v1.4.5 (released Jun 22, 2026, 67 days before disclosure).
The latest release, v1.4.6, is not affected.
- CVE-2026-55784High 7.5
free5GC AUSF authentication contexts can be overwritten by concurrent requests for the same SUPI
Affected: all versions; through 1.4.4.
No fix released. The latest release, v1.4.6, is still affected.
- CVE-2026-53551Medium 6.9
free5GC AUSF: null byte injection in supiOrSuci causes HTTP 500 internal service failure
Affected: fixed in 1.4.5.
Fixed in v1.4.5 (released Jun 22, 2026, 39 days before disclosure).
The latest release, v1.4.6, is not affected.
- CVE-2026-33063High 8.7
free5GC AUSF UE Authentication Panic on Nil SuciSupiMap Interface Conversion
Affected: fixed in 1.4.2.
Fixed in v1.4.2 (released Feb 6, 2026, 42 days before disclosure).
The latest release, v1.4.6, is not affected.