Vulnerabilities

TI-2026-30449 CVE-2026-42081 · GHSA-77x9-rf64-92gv

free5GC: UE Security Capability bypass on NGAP PathSwitchRequest

MEDIUM 64

free5GC is an open-source implementation of the 5G core network.

CVSS 3.1HIGH 7.1 Adjacent network No auth No interaction EPSS 0.00266 Published 2026-05-27 Fixed in 4.2.2 CWE-358

TI-2026-30450 CVE-2026-42082 · GHSA-vrrx-58h3-prmh

free5GC: Missing Concurrent NAS SMC Validation During NGAP Handover

MEDIUM 58

free5GC is an open-source implementation of the 5G core network.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00251 Published 2026-05-27 Fixed in 4.2.2 CWE-358

TI-2026-30451 CVE-2026-42083 · GHSA-6rgm-gr97-x3j5

Missing authorization in free5gc

HIGH 75

free5GC is an open-source implementation of the 5G core network.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00323 Published 2026-05-27 Fixed in 4.2.2, 1.4.3 CWE-862

TI-2026-30748 CVE-2026-42459 · GHSA-585v-hcgf-jhfr

Improper input validation in free5gc

HIGH 73

free5GC is an open-source implementation of the 5G core network.

CVSS 4.0HIGH 7.7 Network No auth No interaction EPSS 0.00324 Published 2026-05-27 Fixed in 4.2.2 CWE-20

TI-2026-32283 CVE-2026-44315 · GHSA-5f62-53r8-qrqf

Missing authorization in free5gc

HIGH 80

free5GC is an open-source implementation of the 5G core network.

CVSS 3.1CRITICAL 9.4 Network No auth No interaction EPSS 0.00314 Published 2026-05-27 Fixed in 4.2.2 CWE-862

TI-2026-32284 CVE-2026-44316 · GHSA-wr8j-6chw-gm6p

free5GC: PCF npcf-smpolicycontrol POST /sm-policies panics on downstream UDR/OpenAPI 404 via nil pointer dereference

HIGH 72

free5GC is an open-source implementation of the 5G core network.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00404 Published 2026-05-27 Fixed in 4.2.2, 1.4.2 CWE-476

TI-2026-32285 CVE-2026-44317 · GHSA-wwqh-7jm5-gj7w

NULL pointer dereference in free5gc

MEDIUM 62

free5GC is an open-source implementation of the 5G core network.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0035 Published 2026-05-27 Fixed in 4.2.2, 1.4.3 CWE-476

TI-2026-32287 CVE-2026-44319 · GHSA-rxrq-fv76-26pr

free5GC: NEF crashes via logger.Fatal on PFD notification delivery failure (attacker-controlled notifyUri)

HIGH 72

free5GC is an open-source implementation of the 5G core network.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00404 Published 2026-05-27 Fixed in 4.2.2, 1.2.3 CWE-20

TI-2026-32288 CVE-2026-44320 · GHSA-wqfh-gq79-j8mf

Missing authentication in free5gc

LOW 38

free5GC is an open-source implementation of the 5G core network.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.00241 Published 2026-05-27 Fixed in 4.2.2 CWE-306

TI-2026-32289 CVE-2026-44321 · GHSA-44qj-cghf-9p97

Missing authentication in free5gc

HIGH 72

free5GC is an open-source implementation of the 5G core network.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00364 Published 2026-05-27 Fixed in 4.2.2 CWE-306

TI-2026-32290 CVE-2026-44322 · GHSA-j59f-x285-69jx

NULL pointer dereference in free5gc

HIGH 72

free5GC is an open-source implementation of the 5G core network.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0039 Published 2026-05-27 Fixed in 4.2.2, 1.2.3 CWE-476

TI-2026-32291 CVE-2026-44323 · GHSA-4rqf-grm6-vf75

free5GC: UDR nudr-dr DELETE amf-subscriptions panics on missing subsId when UE state exists (nil pointer dereference)

LOW 29

free5GC is an open-source implementation of the 5G core network.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0035 Published 2026-05-27 Fixed in 4.2.2, 1.4.3 CWE-476

TI-2026-32292 CVE-2026-44324 · GHSA-jqfc-gwj5-3w63

Incorrect type conversion in free5gc

MEDIUM 62

free5GC is an open-source implementation of the 5G core network.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0042 Published 2026-05-27 Fixed in 4.2.2, 1.4.3 CWE-704

TI-2026-32293 CVE-2026-44325 · GHSA-f8qv-7x5w-qr48

free5GC: NRF POST /oauth2/token structured-form parser type-confusion panic family (Reflect.Set on incompatible types)

HIGH 72

free5GC is an open-source implementation of the 5G core network.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00394 Published 2026-05-27 Fixed in 4.2.2, 1.4.3 CWE-20

TI-2026-32294 CVE-2026-44326 · GHSA-3p28-73q7-45xp

Missing authorization in free5gc

HIGH 80

free5GC is an open-source implementation of the 5G core network.

CVSS 3.1CRITICAL 9.4 Network No auth No interaction EPSS 0.00311 Published 2026-05-27 Fixed in 4.2.2 CWE-862

TI-2026-32295 CVE-2026-44327 · GHSA-cmpj-2x3g-m7g3

free5GC: NEF nnef-oam route group is unauthenticated; no-token requests reach the OAM handler

HIGH 82

free5GC is an open-source implementation of the 5G core network.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00311 Published 2026-05-27 Fixed in 4.2.2 CWE-306

TI-2026-32296 CVE-2026-44328 · GHSA-p9mg-74mg-cwwr

Missing authentication in free5gc

HIGH 75

free5GC is an open-source implementation of the 5G core network.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00324 Published 2026-05-27 Fixed in 4.2.2, 1.4.3 CWE-306

TI-2026-32297 CVE-2026-44329 · GHSA-3258-qmv8-frp3

free5GC: SMF UPI management interface lacks auth middleware; unauthenticated topology read/write requests reach handlers

HIGH 82

free5GC is an open-source implementation of the 5G core network.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00331 Published 2026-05-27 Fixed in 4.2.2, 1.4.3 CWE-306

TI-2026-32298 CVE-2026-44330 · GHSA-rwww-x45w-p52w

Incorrect authorization in free5gc

HIGH 82

free5GC is an open-source implementation of the 5G core network.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00287 Published 2026-05-27 Fixed in 4.2.2 CWE-863

TI-2026-32286 CVE-2026-44318 · GHSA-27ph-8q4f-h7m7

Race condition in free5gc

MEDIUM 62

free5GC is an open-source implementation of the 5G core network.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00332 Published 2026-05-27 Fixed in 4.2.2, 1.0.2 CWE-362

TI-2026-29764 CVE-2026-41136 · GHSA-r99v-75p9-xqm5

free5GC AMF missing default case in Content-Type switch in HTTPUEContextTransfer

MEDIUM 64

free5GC AMF provides Access & Mobility Management Function (AMF) for free5GC, an an open-source project for 5th generation (5G) mobile core networks.

CVSS 4.0MEDIUM 5.5 Network No auth No interaction EPSS 0.00282 Published 2026-04-21 Fixed in 1.4.3 CWE-440

TI-2026-29763 CVE-2026-41135 · GHSA-98cp-84m9-q3qp

free5GC PCF: Memory Leak via CORS Middleware Registration in HTTP Handler Leads to Denial of Service

HIGH 72

free5GC UDR is the Policy Control Function (PCF) for free5GC, an an open-source project for 5th generation (5G) mobile core networks.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00515 Published 2026-04-21 Fixed in 1.4.3 CWE-400

TI-2026-29118 CVE-2026-40343 · GHSA-jwch-w7wh-gqjm

free5GC UDR: Fail-open handling in PolicyDataSubsToNotifyPost allows unintended subscription creation

MEDIUM 48

free5GC UDR is the user data repository (UDR) for free5GC, an an open-source project for 5th generation (5G) mobile core networks.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.08627 Published 2026-04-21 No fix listed CWE-754

TI-2026-29043 CVE-2026-40249 · GHSA-gx38-8h33-pmxr

Improper check for unusual conditions in free5gc

LOW 38

free5GC is an open-source implementation of the 5G core network.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00321 Published 2026-04-16 No fix listed CWE-636

TI-2026-29042 CVE-2026-40248 · GHSA-jgq2-qv8v-5cmj

free5gc UDR improper path validation allows unauthenticated creation and modification of Traffic Influence Subscriptions

HIGH 77

free5GC is an open-source implementation of the 5G core network.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00427 Published 2026-04-16 No fix listed CWE-285

Vulnerabilities

Filters