TI-2024-26883 CVE-2024-40130 · GHSA-997q-9m6q-gr23
open5gs v2.6.4 is vulnerable to Buffer Overflow.
Priority HIGH 82
open5gs v2.6.4 is vulnerable to Buffer Overflow.
Open5GS
Records160All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical3CVSS 9.0–10.0
CVSS high51CVSS 7.0–8.9
Exploited now
Open5GS records in CISA KEVNo Open5GS vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
160 records
TI-2024-26882 CVE-2024-40129 · GHSA-55w4-2fh8-255h
Open5GS v2.6.4 is vulnerable to Buffer Overflow.
Priority HIGH 81
Open5GS v2.6.4 is vulnerable to Buffer Overflow.
TI-2024-22649 CVE-2024-34235 · GHSA-46hp-7jph-mgxf
Open5GS MME versions <= 2.6.4 contains an assertion that can be remotely triggered via a…
Priority HIGH 78
Open5GS MME versions <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface.
TI-2023-18757 CVE-2023-37023 · GHSA-x7pq-2j3f-24rv
Open5GS MME versions <= 2.6.4 contain a reachable assertion in the `Uplink NAS Transport`…
Priority HIGH 78
Open5GS MME versions <= 2.6.4 contain a reachable assertion in the `Uplink NAS Transport` packet handler.
TI-2023-18755 CVE-2023-37021 · GHSA-2g4r-3v66-3h7f
Open5GS MME version <= 2.6.4 contains an assertion that can be remotely triggered via a…
Priority HIGH 78
Open5GS MME version <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface.
TI-2023-18754 CVE-2023-37020 · GHSA-697m-mg58-66vr
Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a…
Priority HIGH 78
Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface.
TI-2023-18753 CVE-2023-37019 · GHSA-mvjr-xfhv-mwpw
Open5GS MME versions <= 2.6.4 contains an assertion that can be remotely triggered via a…
Priority HIGH 78
Open5GS MME versions <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface.
TI-2023-18752 CVE-2023-37018 · GHSA-8254-xv48-7mrq
Open5GS MME versions <= 2.6.4 contains an assertion that can be remotely triggered via a…
Priority HIGH 78
Open5GS MME versions <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface.
TI-2023-18751 CVE-2023-37017 · GHSA-qcjc-qmxq-wf6x
Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a…
Priority HIGH 78
Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface.
TI-2023-18750 CVE-2023-37016 · GHSA-c874-8h7r-5764
Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a…
Priority HIGH 78
Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface.
TI-2023-18749 CVE-2023-37015 · GHSA-h483-px82-mchv
Open5GS MME versions <= 2.6.4 contains an assertion that can be remotely triggered via a…
Priority HIGH 78
Open5GS MME versions <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface.
TI-2026-80460 CVE-2026-116543 · GHSA-wvpv-4m2j-8jmq
Heap out-of-bounds write in Open5GS SBI multipart parser
Priority HIGH 77
Open5GS 1.3.0 through 2.8.0 contains a heap out-of-bounds write vulnerability in parse_multipart() that allows unauthenticated attackers to corrupt memory by supplying an empty multipart boundary.
TI-2026-13227 CVE-2026-15720 · GHSA-2vfm-v289-h559
Pre-auth heap out-of-bounds read in the AMF NAS 5GS mobile-identity handler
Priority HIGH 76
In Open5GS through version 2.7.7 a pre-authentication heap out-of-bounds read in the AMF NAS 5GS mobile-identity handler may result in subscriber-wide denial of service.
TI-2024-16124 CVE-2024-24429 · GHSA-5xmq-mwgg-pjp2
A reachable assertion in the nas_eps_send_emm_to_esm function of Open5GS <= 2.6.4 allows…
Priority HIGH 76
A reachable assertion in the nas_eps_send_emm_to_esm function of Open5GS <= 2.6.4 allows attackers to cause a Denial of Service (DoS) via a crafted NGAP packet.
TI-2025-40390 CVE-2025-65559 · GHSA-vpvv-3968-xxmc
An issue was discovered in Open5GS 2.7.5-49-g465e90f, when processing a PFCP Session…
Priority HIGH 72
An issue was discovered in Open5GS 2.7.5-49-g465e90f, when processing a PFCP Session Establishment Request (type=50), the UPF crashes with a reachable assertion in `lib/pfcp/context.c` (`ogs_pfcp_object_teid_hash_set`) i…
TI-2025-32527 CVE-2025-52322 · GHSA-mqj6-43wr-g628
An issue in Open5GS v2.7.2 and before allows a remote attacker to cause a denial of…
Priority HIGH 72
An issue in Open5GS v2.7.2 and before allows a remote attacker to cause a denial of service via a crafted Create Session Request message to the SMF (PGW-C), using the IP address of a legitimate UE in the PDN Address Allo…
TI-2025-21046 CVE-2025-29339 · GHSA-v7m9-pm9f-frqg
An issue in UPF in Open5GS UPF versions up to v2.7.2 results an assertion failure…
Priority HIGH 72
An issue in UPF in Open5GS UPF versions up to v2.7.2 results an assertion failure vulnerability in PFCP session parameter validation.
TI-2024-37921 CVE-2024-57519 · GHSA-8hpx-q4cx-gfxw
An issue in Open5GS v.2.7.2 allows a remote attacker to cause a denial of service via the…
Priority HIGH 72
An issue in Open5GS v.2.7.2 allows a remote attacker to cause a denial of service via the ogs_dbi_auth_info function in lib/dbi/subscription.c file.
TI-2024-37706 CVE-2024-56921 · GHSA-6wm8-q34j-2mc2
An issue was discovered in Open5gs v2.7.2.
Priority HIGH 72
An issue was discovered in Open5gs v2.7.2.
TI-2024-34270 CVE-2024-51179 · GHSA-gw8m-ww5h-rf9w
An issue in Open 5GS v.2.7.1 allows a remote attacker to cause a denial of service via…
Priority HIGH 72
An issue in Open 5GS v.2.7.1 allows a remote attacker to cause a denial of service via the Network Function Virtualizations (NFVs) such as the User Plane Function (UPF) and the Session Management Function (SMF), The Pack…
TI-2024-16125 CVE-2024-24430 · GHSA-mf84-jxh2-rc4j
A reachable assertion in the mme_ue_find_by_imsi function of Open5GS <= 2.6.4 allows…
Priority HIGH 72
A reachable assertion in the mme_ue_find_by_imsi function of Open5GS <= 2.6.4 allows attackers to cause a Denial of Service (DoS) via a crafted NAS packet.
TI-2022-21081 CVE-2022-43223 · GHSA-f6ch-pgg4-hhv4
open5gs v2.4.11 was discovered to contain a memory leak in the component ngap-handler.c.
Priority HIGH 72
open5gs v2.4.11 was discovered to contain a memory leak in the component ngap-handler.c.
TI-2022-21080 CVE-2022-43222 · GHSA-xw5h-8j92-59pp
open5gs v2.4.11 was discovered to contain a memory leak in the component…
Priority HIGH 72
open5gs v2.4.11 was discovered to contain a memory leak in the component src/smf/pfcp-path.c.
TI-2022-21079 CVE-2022-43221 · GHSA-hph8-r9jg-pg83
open5gs v2.4.11 was discovered to contain a memory leak in the component…
Priority HIGH 72
open5gs v2.4.11 was discovered to contain a memory leak in the component src/upf/pfcp-path.c.
TI-2022-19468 CVE-2022-40890 · GHSA-vvm2-vqx3-q379
A vulnerability in /src/amf/amf-context.c in Open5GS 2.4.10 and earlier leads to AMF denial of service.
Priority HIGH 72
A vulnerability in /src/amf/amf-context.c in Open5GS 2.4.10 and earlier leads to AMF denial of service.