GoPackage

github.com/free5gc/smf

3 known vulnerabilities (1 critical, 2 high), with the versions each affects and the releases that fix them.

Latest release: v1.4.6 (Sep 30, 2026): affected by CVE-2026-44321
Newest unaffected release: Every release is affected by at least one advisory
Advisories: 3 · 1 critical, 2 high

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

CVE-2026-44321High 7.5
free5GC: SMF UPI POST /upi/v1/upNodesLinks exits the SMF process on overlapping UE pools (unauthenticated, reachable Fatalf)
Affected: all versions; through 1.4.3.
No fix released. The latest release, v1.4.6, is still affected.
CVE-2026-44328High 8.2
free5GC: SMF UPI DELETE /upi/v1/upNodesLinks/{ref} panics on AN-node deletion via nil UPF dereference; unauthenticated, state-mutating
Affected: fixed in 1.4.3.
Fixed in v1.4.3 (released Apr 16, 2026, 41 days before disclosure).
The latest release, v1.4.6, is not affected.
CVE-2026-44329Critical 10.0
free5GC: SMF UPI management interface lacks auth middleware; unauthenticated topology read/write requests reach handlers
Affected: fixed in 1.4.3.
Fixed in v1.4.3 (released Apr 16, 2026, 41 days before disclosure).
The latest release, v1.4.6, is not affected.