# cve.now: Free5gc

The newest entries naming Free5gc as an affected vendor (up to 200), of 58 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-47780](https://cve.now/CVE-2026-47780.md): free5GC: UDR Improper ueId validation in free5GC EE subscription handlers allows arbitrary identifier persistence (CVSS 6.9)
- [CVE-2026-55785](https://cve.now/CVE-2026-55785.md): free5GC AUSF uses non-constant-time authentication comparisons and logs XRES\* in 5G-AKA (CVSS 3.7)
- [CVE-2026-55784](https://cve.now/CVE-2026-55784.md): free5GC AUSF authentication contexts can be overwritten by concurrent requests for the same SUPI (CVSS 7.5)
- [CVE-2026-55068](https://cve.now/CVE-2026-55068.md): free5GC: NRF nnrf-nfm lacks NF Profile input validation — enables NF Registration Poisoning with arbitrary service endpoints (CVSS 9.3)
- [CVE-2026-53551](https://cve.now/CVE-2026-53551.md): free5GC AUSF: null byte injection in supiOrSuci causes HTTP 500 internal service failure (CVSS 6.9)
- [CVE-2026-42081](https://cve.now/CVE-2026-42081.md): free5GC: UE Security Capability bypass on NGAP PathSwitchRequest (CVSS 6.1)
- [CVE-2026-42082](https://cve.now/CVE-2026-42082.md): free5GC: Missing Concurrent NAS SMC Validation During NGAP Handover (CVSS 3.7)
- [CVE-2026-42083](https://cve.now/CVE-2026-42083.md): free5GC: PCF Npcf\_SMPolicyControl missing authentication middleware allows unauthenticated access to SM policy handlers and disclosure of subscriber SUPI (CVSS 8.2)
- [CVE-2026-42459](https://cve.now/CVE-2026-42459.md): free5GC: Improper Input Validation and Generation of Error Message Containing Sensitive Information in github.com/free5gc/udm (CVSS 7.7)
- [CVE-2026-44315](https://cve.now/CVE-2026-44315.md): free5GC: NEF 3gpp-pfd-management API is unauthenticated; forged bearer tokens can create, read, and delete PFD transactions (CVSS 9.4)
- [CVE-2026-44316](https://cve.now/CVE-2026-44316.md): free5GC: PCF npcf-smpolicycontrol POST /sm-policies panics on downstream UDR/OpenAPI 404 via nil pointer dereference (CVSS 7.5)
- [CVE-2026-44317](https://cve.now/CVE-2026-44317.md): free5GC: PCF npcf-policyauthorization POST /app-sessions panics on suppFeat=1 with missing AfRoutReq via nil pointer dereference (CVSS 6.5)
- [CVE-2026-44319](https://cve.now/CVE-2026-44319.md): free5GC: NEF crashes via logger.Fatal on PFD notification delivery failure (attacker-controlled notifyUri) (CVSS 7.5)
- [CVE-2026-44320](https://cve.now/CVE-2026-44320.md): free5GC: NEF nnef-callback route group is unauthenticated; forged callback requests are accepted into the processing path (CVSS 7.3)
- [CVE-2026-44321](https://cve.now/CVE-2026-44321.md): free5GC: SMF UPI POST /upi/v1/upNodesLinks exits the SMF process on overlapping UE pools (unauthenticated, reachable Fatalf) (CVSS 7.5)
- [CVE-2026-44322](https://cve.now/CVE-2026-44322.md): free5GC: NEF 3gpp-pfd-management PATCH applications/{appId} panics on UDR access failure due to nil ProblemDetails dereference (CVSS 7.5)
- [CVE-2026-44323](https://cve.now/CVE-2026-44323.md): free5GC: UDR nudr-dr DELETE amf-subscriptions panics on missing subsId when UE state exists (nil pointer dereference) (CVSS 4.3)
- [CVE-2026-44324](https://cve.now/CVE-2026-44324.md): free5GC: UDR nudr-dr DELETE amf-subscriptions panics on missing UE state via nil interface type assertion (single authenticated request) (CVSS 6.5)
- [CVE-2026-44325](https://cve.now/CVE-2026-44325.md): free5GC: NRF POST /oauth2/token structured-form parser type-confusion panic family (Reflect.Set on incompatible types) (CVSS 7.5)
- [CVE-2026-44326](https://cve.now/CVE-2026-44326.md): free5GC: NEF 3gpp-traffic-influence API is unauthenticated; missing or forged bearer tokens can create, read, patch, and delete subscriptions (CVSS 9.4)
- [CVE-2026-44327](https://cve.now/CVE-2026-44327.md): free5GC: NEF nnef-oam route group is unauthenticated; no-token requests reach the OAM handler (CVSS 10.0)
- [CVE-2026-44328](https://cve.now/CVE-2026-44328.md): free5GC: SMF UPI DELETE /upi/v1/upNodesLinks/{ref} panics on AN-node deletion via nil UPF dereference; unauthenticated, state-mutating (CVSS 8.2)
- [CVE-2026-44329](https://cve.now/CVE-2026-44329.md): free5GC: SMF UPI management interface lacks auth middleware; unauthenticated topology read/write requests reach handlers (CVSS 10.0)
- [CVE-2026-44330](https://cve.now/CVE-2026-44330.md): free5GC: NEF nnef-pfdmanagement API is unauthenticated; forged bearer tokens can read PFD data and create/delete PFD subscriptions (CVSS 10.0)
- [CVE-2026-44318](https://cve.now/CVE-2026-44318.md): free5GC: BSF concurrent PUT /nbsf-management/v1/subscriptions/{subId} crashes the BSF process via concurrent map read/write on Subscriptions (CVSS 6.5)
- [CVE-2026-41136](https://cve.now/CVE-2026-41136.md): free5GC AMF missing default case in Content-Type switch in HTTPUEContextTransfer (CVSS 5.5)
- [CVE-2026-41135](https://cve.now/CVE-2026-41135.md): free5GC PCF: Memory Leak via CORS Middleware Registration in HTTP Handler Leads to Denial of Service (CVSS 7.5)
- [CVE-2026-40343](https://cve.now/CVE-2026-40343.md): free5GC UDR: Fail-open handling in PolicyDataSubsToNotifyPost allows unintended subscription creation (CVSS 6.9)
- [CVE-2026-40249](https://cve.now/CVE-2026-40249.md): free5gc UDR fail-open request handling in PolicyDataSubsToNotifySubsIdPut may allow unintended subscription updates after input errors (CVSS 6.9)
- [CVE-2026-40248](https://cve.now/CVE-2026-40248.md): free5gc UDR improper path validation allows unauthenticated creation and modification of Traffic Influence Subscriptions (CVSS 8.7)
- [CVE-2026-40247](https://cve.now/CVE-2026-40247.md): free5gc UDR improper path validation allows unauthenticated access to Traffic Influence Subscriptions (CVSS 8.7)
- [CVE-2026-40246](https://cve.now/CVE-2026-40246.md): free5gc UDR improper path validation allows unauthenticated deletion of Traffic Influence Subscriptions (CVSS 8.7)
- [CVE-2026-40245](https://cve.now/CVE-2026-40245.md): Free5GC: UDR nudr-dr influenceData/subs-to-notify leaks SUPI in error response body without authentication (CVSS 7.5)
- [CVE-2026-33192](https://cve.now/CVE-2026-33192.md): free5GC UDM incorrectly returns 500 for empty supi path parameter in PATCH sdm-subscriptions reques (CVSS 8.7)
- [CVE-2026-33065](https://cve.now/CVE-2026-33065.md): free5GC UDM incorrectly returns 500 for empty supi path parameter in DELETE sdm-subscriptions request (CVSS 6.9)
- [CVE-2026-33064](https://cve.now/CVE-2026-33064.md): free5GC UDM DataChangeNotification Procedure Panic Due to Nil Pointer Dereference (CVSS 8.7)
- [CVE-2026-33191](https://cve.now/CVE-2026-33191.md): free5GC UDM vulnerable to null byte injection in URL path parameters causing 500 Internal Server Error (CVSS 8.7)
- [CVE-2026-33063](https://cve.now/CVE-2026-33063.md): free5GC AUSF UE Authentication Panic on Nil SuciSupiMap Interface Conversion (CVSS 8.7)
- [CVE-2026-33062](https://cve.now/CVE-2026-33062.md): free5GC NRF Discovery EncodeGroupId Function Panics on Malformed group-id-list Parameter (CVSS 8.7)
- [CVE-2026-32937](https://cve.now/CVE-2026-32937.md): free5GC CHF has Out-of-Bounds Slice Access that Leads to DoS (CVSS 7.1)
- [CVE-2026-27643](https://cve.now/CVE-2026-27643.md): free5GC has improper error handling in NEF with information exposure (CVSS 6.6)
- [CVE-2026-27642](https://cve.now/CVE-2026-27642.md): free5GC has Improper Input Validation in UDM UEAU Service (CVSS 6.6)
- [CVE-2026-26025](https://cve.now/CVE-2026-26025.md): free5GC SMF crash (nil pointer dereference) on PFCP SessionReportRequest when ReportType.USAR=1 and UsageReport omits mandatory URRID sub-IE  (CVSS 6.6)
- [CVE-2026-26024](https://cve.now/CVE-2026-26024.md): free5GC SMF crash (nil pointer dereference) on PFCP SessionReportRequest when ReportType.USAR=1 and UsageReport omits mandatory URRID sub-IE  (CVSS 6.6)
- [CVE-2026-25501](https://cve.now/CVE-2026-25501.md): free5GC SMF crash (nil pointer dereference) on PFCP SessionReportRequest when ReportType.DLDR is set but DownlinkDataReport IE is missing (CVSS 6.6)
- [CVE-2025-69253](https://cve.now/CVE-2025-69253.md): free5GC vulnerable to improper error handling in NEF with information exposure (CVSS 6.6)
- [CVE-2025-69252](https://cve.now/CVE-2025-69252.md): free5GC has Null Pointer Dereference in UDM, Leading to Service Panic (CVSS 6.6)
- [CVE-2025-69251](https://cve.now/CVE-2025-69251.md): free5GC has Improper Input Validation in UDM, Leading to Information Exposure (CVSS 6.6)
- [CVE-2025-69250](https://cve.now/CVE-2025-69250.md): free5GC has Improper Error Handling in UDM, Leading to Information Exposure (CVSS 6.6)
- [CVE-2025-69248](https://cve.now/CVE-2025-69248.md): free5GC has Array Index Out of Bounds in AMF Leading to Denial of Service (CVSS 6.6)
- [CVE-2025-69247](https://cve.now/CVE-2025-69247.md): free5GC has Heap Buffer Overflow in UPF Leading to Denial of Service (CVSS 2.7)
- [CVE-2025-69232](https://cve.now/CVE-2025-69232.md): free5GC hasProtocol Compliance Violation in UPF Leading to SMF Service Disruption (CVSS 2.7)
- [CVE-2025-69208](https://cve.now/CVE-2025-69208.md): free5GC UDR's NEF incorrectly returns 500 for missing PFD data (UDR 404) in Nnef\_PfdManagement GET request (CVSS 2.7)
- [CVE-2026-1739](https://cve.now/CVE-2026-1739.md): Free5GC pcf smpolicy.go HandleCreateSmPolicyRequest null pointer dereference (CVSS 6.9)
- [CVE-2026-1684](https://cve.now/CVE-2026-1684.md): Free5GC SMF PFCP UDP Endpoint pfcp\_reports.go HandleReports denial of service (CVSS 6.9)
- [CVE-2026-1683](https://cve.now/CVE-2026-1683.md): Free5GC SMF PFCP handler.go HandlePfcpSessionReportRequest denial of service (CVSS 6.9)
- [CVE-2026-1682](https://cve.now/CVE-2026-1682.md): Free5GC SMF PFCP UDP Endpoint handler.go HandlePfcpAssociationReleaseRequest null pointer dereference (CVSS 6.9)
- [CVE-2023-4659](https://cve.now/CVE-2023-4659.md): Cross-Site Request Forgery in Free5Gc (CVSS 9.8)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/free5gc
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.