Vulnerabilities

TI-2026-29763 CVE-2026-41135 · GHSA-98cp-84m9-q3qp

free5GC PCF: Memory Leak via CORS Middleware Registration in HTTP Handler Leads to Denial of Service

HIGH 72

free5GC UDR is the Policy Control Function (PCF) for free5GC, an an open-source project for 5th generation (5G) mobile core networks.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00515 Published 2026-04-21 Fixed in 1.4.3 CWE-400

TI-2026-01422 CVE-2026-1739 · GHSA-659g-9v9q-gq45

HIGH 70

A vulnerability has been found in Free5GC pcf up to 1.4.1.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00773 Published 2026-02-02 No fix listed CWE-404

TI-2025-41046 CVE-2025-66720 · GHSA-8c8h-f234-pmx3

HIGH 72

Null pointer dereference in free5gc pcf 1.4.0 in file internal/sbi/processor/ampolicy.go in function HandleDeletePoliciesPolAssoId.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00464 Published 2026-01-23 No fix listed CWE-476