Free5gc vulnerabilities
58 CVEs and advisories name Free5gc as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-40247free5gc UDR improper path validation allows unauthenticated access to Traffic Influence Subscriptions
- CVE-2026-40246free5gc UDR improper path validation allows unauthenticated deletion of Traffic Influence Subscriptions
- CVE-2026-40245Free5GC: UDR nudr-dr influenceData/subs-to-notify leaks SUPI in error response body without authentication
- CVE-2026-33192free5GC UDM incorrectly returns 500 for empty supi path parameter in PATCH sdm-subscriptions reques
- CVE-2026-33065free5GC UDM incorrectly returns 500 for empty supi path parameter in DELETE sdm-subscriptions request
- CVE-2026-33064free5GC UDM DataChangeNotification Procedure Panic Due to Nil Pointer Dereference
- CVE-2026-33191free5GC UDM vulnerable to null byte injection in URL path parameters causing 500 Internal Server Error
- CVE-2026-33063free5GC AUSF UE Authentication Panic on Nil SuciSupiMap Interface Conversion
- CVE-2026-33062free5GC NRF Discovery EncodeGroupId Function Panics on Malformed group-id-list Parameter
- CVE-2026-32937free5GC CHF has Out-of-Bounds Slice Access that Leads to DoS
- CVE-2026-27643free5GC has improper error handling in NEF with information exposure
- CVE-2026-27642free5GC has Improper Input Validation in UDM UEAU Service
- CVE-2026-26025free5GC SMF crash (nil pointer dereference) on PFCP SessionReportRequest when ReportType.USAR=1 and UsageReport omits mandatory URRID sub-IE 
- CVE-2026-26024free5GC SMF crash (nil pointer dereference) on PFCP SessionReportRequest when ReportType.USAR=1 and UsageReport omits mandatory URRID sub-IE 
- CVE-2026-25501free5GC SMF crash (nil pointer dereference) on PFCP SessionReportRequest when ReportType.DLDR is set but DownlinkDataReport IE is missing
- CVE-2025-69253free5GC vulnerable to improper error handling in NEF with information exposure
- CVE-2025-69252free5GC has Null Pointer Dereference in UDM, Leading to Service Panic
- CVE-2025-69251free5GC has Improper Input Validation in UDM, Leading to Information Exposure
- CVE-2025-69250free5GC has Improper Error Handling in UDM, Leading to Information Exposure
- CVE-2025-69248free5GC has Array Index Out of Bounds in AMF Leading to Denial of Service
- CVE-2025-69247free5GC has Heap Buffer Overflow in UPF Leading to Denial of Service
- CVE-2025-69232free5GC hasProtocol Compliance Violation in UPF Leading to SMF Service Disruption
- CVE-2025-69208free5GC UDR's NEF incorrectly returns 500 for missing PFD data (UDR 404) in Nnef_PfdManagement GET request
- CVE-2026-1739Free5GC pcf smpolicy.go HandleCreateSmPolicyRequest null pointer dereference
- CVE-2026-1684Free5GC SMF PFCP UDP Endpoint pfcp_reports.go HandleReports denial of service
- CVE-2026-1683Free5GC SMF PFCP handler.go HandlePfcpSessionReportRequest denial of service
- CVE-2026-1682Free5GC SMF PFCP UDP Endpoint handler.go HandlePfcpAssociationReleaseRequest null pointer dereference
- CVE-2023-4659Cross-Site Request Forgery in Free5Gc