Free5gc vulnerabilities
58 CVEs and advisories name Free5gc as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-47780free5GC: UDR Improper ueId validation in free5GC EE subscription handlers allows arbitrary identifier persistence
- CVE-2026-55785free5GC AUSF uses non-constant-time authentication comparisons and logs XRES* in 5G-AKA
- CVE-2026-55784free5GC AUSF authentication contexts can be overwritten by concurrent requests for the same SUPI
- CVE-2026-55068free5GC: NRF nnrf-nfm lacks NF Profile input validation — enables NF Registration Poisoning with arbitrary service endpoints
- CVE-2026-53551free5GC AUSF: null byte injection in supiOrSuci causes HTTP 500 internal service failure
- CVE-2026-42081free5GC: UE Security Capability bypass on NGAP PathSwitchRequest
- CVE-2026-42082free5GC: Missing Concurrent NAS SMC Validation During NGAP Handover
- CVE-2026-42083free5GC: PCF Npcf_SMPolicyControl missing authentication middleware allows unauthenticated access to SM policy handlers and disclosure of subscriber SUPI
- CVE-2026-42459free5GC: Improper Input Validation and Generation of Error Message Containing Sensitive Information in github.com/free5gc/udm
- CVE-2026-44315free5GC: NEF 3gpp-pfd-management API is unauthenticated; forged bearer tokens can create, read, and delete PFD transactions
- CVE-2026-44316free5GC: PCF npcf-smpolicycontrol POST /sm-policies panics on downstream UDR/OpenAPI 404 via nil pointer dereference
- CVE-2026-44317free5GC: PCF npcf-policyauthorization POST /app-sessions panics on suppFeat=1 with missing AfRoutReq via nil pointer dereference
- CVE-2026-44319free5GC: NEF crashes via logger.Fatal on PFD notification delivery failure (attacker-controlled notifyUri)
- CVE-2026-44320free5GC: NEF nnef-callback route group is unauthenticated; forged callback requests are accepted into the processing path
- CVE-2026-44321free5GC: SMF UPI POST /upi/v1/upNodesLinks exits the SMF process on overlapping UE pools (unauthenticated, reachable Fatalf)
- CVE-2026-44322free5GC: NEF 3gpp-pfd-management PATCH applications/{appId} panics on UDR access failure due to nil ProblemDetails dereference
- CVE-2026-44323free5GC: UDR nudr-dr DELETE amf-subscriptions panics on missing subsId when UE state exists (nil pointer dereference)
- CVE-2026-44324free5GC: UDR nudr-dr DELETE amf-subscriptions panics on missing UE state via nil interface type assertion (single authenticated request)
- CVE-2026-44325free5GC: NRF POST /oauth2/token structured-form parser type-confusion panic family (Reflect.Set on incompatible types)
- CVE-2026-44326free5GC: NEF 3gpp-traffic-influence API is unauthenticated; missing or forged bearer tokens can create, read, patch, and delete subscriptions
- CVE-2026-44327free5GC: NEF nnef-oam route group is unauthenticated; no-token requests reach the OAM handler
- CVE-2026-44328free5GC: SMF UPI DELETE /upi/v1/upNodesLinks/{ref} panics on AN-node deletion via nil UPF dereference; unauthenticated, state-mutating
- CVE-2026-44329free5GC: SMF UPI management interface lacks auth middleware; unauthenticated topology read/write requests reach handlers
- CVE-2026-44330free5GC: NEF nnef-pfdmanagement API is unauthenticated; forged bearer tokens can read PFD data and create/delete PFD subscriptions
- CVE-2026-44318free5GC: BSF concurrent PUT /nbsf-management/v1/subscriptions/{subId} crashes the BSF process via concurrent map read/write on Subscriptions
- CVE-2026-41136free5GC AMF missing default case in Content-Type switch in HTTPUEContextTransfer
- CVE-2026-41135free5GC PCF: Memory Leak via CORS Middleware Registration in HTTP Handler Leads to Denial of Service
- CVE-2026-40343free5GC UDR: Fail-open handling in PolicyDataSubsToNotifyPost allows unintended subscription creation
- CVE-2026-40249free5gc UDR fail-open request handling in PolicyDataSubsToNotifySubsIdPut may allow unintended subscription updates after input errors
- CVE-2026-40248free5gc UDR improper path validation allows unauthenticated creation and modification of Traffic Influence Subscriptions