TI-2026-32298 CVE-2026-44330 · GHSA-rwww-x45w-p52w
Incorrect authorization in free5gc
Priority HIGH 82
free5GC is an open-source implementation of the 5G core network.
free5gc
Records87All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical9CVSS 9.0–10.0
CVSS high38CVSS 7.0–8.9
Exploited now
free5gc records in CISA KEVNo free5gc vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
59 records in Free5gc · all components
TI-2026-32297 CVE-2026-44329 · GHSA-3258-qmv8-frp3
free5GC: SMF UPI management interface lacks auth middleware; unauthenticated topology read/write requests reach handlers
Priority HIGH 82
free5GC is an open-source implementation of the 5G core network.
TI-2026-32295 CVE-2026-44327 · GHSA-cmpj-2x3g-m7g3
free5GC: NEF nnef-oam route group is unauthenticated; no-token requests reach the OAM handler
Priority HIGH 82
free5GC is an open-source implementation of the 5G core network.
TI-2025-39412 CVE-2025-63679 · GHSA-7mr7-hhp3-f6qg
free5gc v4.1.0 and before is vulnerable to Buffer Overflow.
Priority HIGH 82
free5gc v4.1.0 and before is vulnerable to Buffer Overflow.
TI-2026-32294 CVE-2026-44326 · GHSA-3p28-73q7-45xp
Missing authorization in free5gc
Priority HIGH 80
free5GC is an open-source implementation of the 5G core network.
TI-2026-32283 CVE-2026-44315 · GHSA-5f62-53r8-qrqf
Missing authorization in free5gc
Priority HIGH 80
free5GC is an open-source implementation of the 5G core network.
TI-2026-29042 CVE-2026-40248 · GHSA-jgq2-qv8v-5cmj
free5gc UDR improper path validation allows unauthenticated creation and modification of Traffic Influence Subscriptions
Priority HIGH 77
free5GC is an open-source implementation of the 5G core network.
TI-2026-32296 CVE-2026-44328 · GHSA-p9mg-74mg-cwwr
Missing authentication in free5gc
Priority HIGH 75
free5GC is an open-source implementation of the 5G core network.
TI-2026-30451 CVE-2026-42083 · GHSA-6rgm-gr97-x3j5
Missing authorization in free5gc
Priority HIGH 75
free5GC is an open-source implementation of the 5G core network.
TI-2026-30748 CVE-2026-42459 · GHSA-585v-hcgf-jhfr
Improper input validation in free5gc
Priority HIGH 73
free5GC is an open-source implementation of the 5G core network.
TI-2026-32293 CVE-2026-44325 · GHSA-f8qv-7x5w-qr48
free5GC: NRF POST /oauth2/token structured-form parser type-confusion panic family (Reflect.Set on incompatible types)
Priority HIGH 72
free5GC is an open-source implementation of the 5G core network.
TI-2026-32290 CVE-2026-44322 · GHSA-j59f-x285-69jx
NULL pointer dereference in free5gc
Priority HIGH 72
free5GC is an open-source implementation of the 5G core network.
TI-2026-32289 CVE-2026-44321 · GHSA-44qj-cghf-9p97
Missing authentication in free5gc
Priority HIGH 72
free5GC is an open-source implementation of the 5G core network.
TI-2026-32287 CVE-2026-44319 · GHSA-rxrq-fv76-26pr
free5GC: NEF crashes via logger.Fatal on PFD notification delivery failure (attacker-controlled notifyUri)
Priority HIGH 72
free5GC is an open-source implementation of the 5G core network.
TI-2026-32284 CVE-2026-44316 · GHSA-wr8j-6chw-gm6p
free5GC: PCF npcf-smpolicycontrol POST /sm-policies panics on downstream UDR/OpenAPI 404 via nil pointer dereference
Priority HIGH 72
free5GC is an open-source implementation of the 5G core network.
TI-2026-29763 CVE-2026-41135 · GHSA-98cp-84m9-q3qp
free5GC PCF: Memory Leak via CORS Middleware Registration in HTTP Handler Leads to Denial of Service
Priority HIGH 72
free5GC UDR is the Policy Control Function (PCF) for free5GC, an an open-source project for 5th generation (5G) mobile core networks.
TI-2026-29039 CVE-2026-40245 · GHSA-wrwh-rpq4-87hf
Free5GC: UDR nudr-dr influenceData/subs-to-notify leaks SUPI in error response body without authentication
Priority HIGH 72
Free5GC is an open-source Linux Foundation project for 5th generation (5G) mobile core networks.
TI-2026-23598 CVE-2026-30653 · GHSA-xwf4-w8f7-pwr9
An issue in Free5GC v.4.2.0 and before allows a remote attacker to cause a denial of…
Priority HIGH 72
An issue in Free5GC v.4.2.0 and before allows a remote attacker to cause a denial of service via the function HandleAuthenticationFailure of the component AMF
TI-2025-43038 CVE-2025-70123 · GHSA-j98c-62jj-x3h3
An improper input validation and protocol compliance vulnerability in free5GC v4.0.1…
Priority HIGH 72
An improper input validation and protocol compliance vulnerability in free5GC v4.0.1 allows remote attackers to cause a denial of service.
TI-2025-43037 CVE-2025-70122 · GHSA-fq6p-4h82-858f
A heap buffer overflow vulnerability in the UPF component of free5GC v4.0.1 allows remote…
Priority HIGH 72
A heap buffer overflow vulnerability in the UPF component of free5GC v4.0.1 allows remote attackers to cause a denial of service via a crafted PFCP Session Modification Request.
TI-2025-43036 CVE-2025-70121 · GHSA-x3j4-874w-h7pv
An array index out of bounds vulnerability in the AMF component of free5GC v4.0.1 allows…
Priority HIGH 72
An array index out of bounds vulnerability in the AMF component of free5GC v4.0.1 allows remote attackers to cause a denial of service via a crafted 5GS Mobile Identity in a NAS Registration Request message.
TI-2025-40392 CVE-2025-65562 · GHSA-7jcm-x89q-2vg2
The free5GC UPF suffers from a lack of bounds checking on the SEID when processing PFCP…
Priority HIGH 72
The free5GC UPF suffers from a lack of bounds checking on the SEID when processing PFCP Session Deletion Requests.
TI-2025-40391 CVE-2025-65561 · GHSA-hrmx-qxp4-vxmf
An issue was discovered in function LocalNode.Sess in free5GC 4.1.0 allowing attackers to…
Priority HIGH 72
An issue was discovered in function LocalNode.Sess in free5GC 4.1.0 allowing attackers to cause a denial of service or other unspecified impacts via crafted header Local SEID to the PFCP Session Modification Request.
TI-2025-37739 CVE-2025-60638 · GHSA-f2hj-vpp9-6vm2
An issue was discovered in Free5GC v4.0.0 and v4.0.1 allowing an attacker to cause a…
Priority HIGH 72
An issue was discovered in Free5GC v4.0.0 and v4.0.1 allowing an attacker to cause a denial of service via crafted POST request to the Nnssf_NSSAIAvailability API.
TI-2023-26979 CVE-2023-49391 · GHSA-jcrr-rr6w-8c83
An issue was discovered in free5GC version 3.3.0, allows remote attackers to execute…
Priority HIGH 72
An issue was discovered in free5GC version 3.3.0, allows remote attackers to execute arbitrary code and cause a denial of service (DoS) on AMF component via crafted NGAP message.