GoPackage

github.com/free5gc/pcf

5 known vulnerabilities (3 high, 2 medium), with the versions each affects and the releases that fix them.

Version timeline

CVE-2026-42083
Affects v1.0.0 to v1.4.2 (v1.4.3 is outside it)
CVE-2026-44316
Affects v1.0.0 to v1.4.1 (v1.4.2 is outside it)
CVE-2026-44317
Affects v1.0.0 to v1.4.2 (v1.4.3 is outside it)
CVE-2026-41135
Affects v1.0.0 to v1.4.2 (v1.4.3 is outside it)
CVE-2025-60632
Affects v1.0.0 to v1.3.2 (v1.4.0 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

CVE-2026-42083High 8.2
free5GC: PCF Npcf_SMPolicyControl missing authentication middleware allows unauthenticated access to SM policy handlers and disclosure of…
Affected: fixed in 1.4.3.
Fixed in v1.4.3 (released Apr 9, 2026, 48 days before disclosure).
The latest release, v1.4.6, is not affected.
CVE-2026-44316High 7.5
free5GC: PCF npcf-smpolicycontrol POST /sm-policies panics on downstream UDR/OpenAPI 404 via nil pointer dereference
Affected: fixed in 1.4.2.
Fixed in v1.4.2 (released Jan 21, 2026, 126 days before disclosure).
The latest release, v1.4.6, is not affected.
CVE-2026-44317Medium 6.5
free5GC: PCF npcf-policyauthorization POST /app-sessions panics on suppFeat=1 with missing AfRoutReq via nil pointer dereference
Affected: fixed in 1.4.3.
Fixed in v1.4.3 (released Apr 9, 2026, 48 days before disclosure).
The latest release, v1.4.6, is not affected.
CVE-2026-41135High 7.5
free5GC PCF: Memory Leak via CORS Middleware Registration in HTTP Handler Leads to Denial of Service
Affected: fixed in 1.4.3.
Fixed in v1.4.3 (released Apr 9, 2026, 12 days before disclosure).
The latest release, v1.4.6, is not affected.
CVE-2025-60632Medium 6.5
An issue was discovered in Free5GC v4.0.0 and v4.0.1 allowing an attacker to cause a denial of service via crafted POST request to the…
Affected: fixed in 1.4.0.
Fixed in v1.4.0 (released Aug 22, 2025, 94 days before disclosure).
The latest release, v1.4.6, is not affected.