Vulnerabilities

TI-2026-35273 CVE-2026-47780 · GHSA-6gxq-gpr8-xgjp

free5GC: UDR Improper ueId validation in free5GC EE subscription handlers allows arbitrary identifier persistence

HIGH 70

free5GC is an open-source implementation of the 5G core network.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00538 Published 2026-09-15 No fix listed CWE-20

TI-2026-40274 CVE-2026-55785 · GHSA-fp46-6vfw-gc9c

free5GC AUSF uses non-constant-time authentication comparisons and logs XRES* in 5G-AKA

LOW 18

free5GC is an open-source implementation of the 5G core network.

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00445 Published 2026-08-28 Fixed in 1.4.5 CWE-208

TI-2026-40273 CVE-2026-55784 · GHSA-334q-h5g3-fpxv

free5GC AUSF authentication contexts can be overwritten by concurrent requests for the same SUPI

HIGH 72

free5GC is an open-source implementation of the 5G core network.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00419 Published 2026-08-28 No fix listed CWE-362

TI-2026-39774 CVE-2026-55068 · GHSA-x8mj-6p3q-g5pp

Improper input validation in free5gc

HIGH 75

free5GC is an open-source implementation of the 5G core network.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.0059 Published 2026-08-28 Fixed in 4.2.3, 4.2.2 CWE-20

TI-2026-38622 CVE-2026-53551 · GHSA-qj55-47fp-p62j

free5GC AUSF: null byte injection in supiOrSuci causes HTTP 500 internal service failure

HIGH 70

free5GC is an open-source implementation of the 5G core network.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00737 Published 2026-07-31 Fixed in 4.2.2, 1.4.5 CWE-20

TI-2026-30449 CVE-2026-42081 · GHSA-77x9-rf64-92gv

free5GC: UE Security Capability bypass on NGAP PathSwitchRequest

MEDIUM 64

free5GC is an open-source implementation of the 5G core network.

CVSS 3.1HIGH 7.1 Adjacent network No auth No interaction EPSS 0.00266 Published 2026-05-27 Fixed in 4.2.2 CWE-358

TI-2026-30450 CVE-2026-42082 · GHSA-vrrx-58h3-prmh

free5GC: Missing Concurrent NAS SMC Validation During NGAP Handover

MEDIUM 58

free5GC is an open-source implementation of the 5G core network.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00251 Published 2026-05-27 Fixed in 4.2.2 CWE-358

TI-2026-30451 CVE-2026-42083 · GHSA-6rgm-gr97-x3j5

Missing authorization in free5gc

HIGH 75

free5GC is an open-source implementation of the 5G core network.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00323 Published 2026-05-27 Fixed in 4.2.2, 1.4.3 CWE-862

TI-2026-30748 CVE-2026-42459 · GHSA-585v-hcgf-jhfr

Improper input validation in free5gc

HIGH 73

free5GC is an open-source implementation of the 5G core network.

CVSS 4.0HIGH 7.7 Network No auth No interaction EPSS 0.00324 Published 2026-05-27 Fixed in 4.2.2 CWE-20

TI-2026-32283 CVE-2026-44315 · GHSA-5f62-53r8-qrqf

Missing authorization in free5gc

HIGH 80

free5GC is an open-source implementation of the 5G core network.

CVSS 3.1CRITICAL 9.4 Network No auth No interaction EPSS 0.00314 Published 2026-05-27 Fixed in 4.2.2 CWE-862

TI-2026-32284 CVE-2026-44316 · GHSA-wr8j-6chw-gm6p

free5GC: PCF npcf-smpolicycontrol POST /sm-policies panics on downstream UDR/OpenAPI 404 via nil pointer dereference

HIGH 72

free5GC is an open-source implementation of the 5G core network.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00404 Published 2026-05-27 Fixed in 4.2.2, 1.4.2 CWE-476

TI-2026-32285 CVE-2026-44317 · GHSA-wwqh-7jm5-gj7w

NULL pointer dereference in free5gc

MEDIUM 62

free5GC is an open-source implementation of the 5G core network.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0035 Published 2026-05-27 Fixed in 4.2.2, 1.4.3 CWE-476

TI-2026-32287 CVE-2026-44319 · GHSA-rxrq-fv76-26pr

free5GC: NEF crashes via logger.Fatal on PFD notification delivery failure (attacker-controlled notifyUri)

HIGH 72

free5GC is an open-source implementation of the 5G core network.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00404 Published 2026-05-27 Fixed in 4.2.2, 1.2.3 CWE-20

TI-2026-32288 CVE-2026-44320 · GHSA-wqfh-gq79-j8mf

Missing authentication in free5gc

LOW 38

free5GC is an open-source implementation of the 5G core network.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.00241 Published 2026-05-27 Fixed in 4.2.2 CWE-306

TI-2026-32289 CVE-2026-44321 · GHSA-44qj-cghf-9p97

Missing authentication in free5gc

HIGH 72

free5GC is an open-source implementation of the 5G core network.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00364 Published 2026-05-27 Fixed in 4.2.2 CWE-306

TI-2026-32290 CVE-2026-44322 · GHSA-j59f-x285-69jx

NULL pointer dereference in free5gc

HIGH 72

free5GC is an open-source implementation of the 5G core network.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0039 Published 2026-05-27 Fixed in 4.2.2, 1.2.3 CWE-476

TI-2026-32291 CVE-2026-44323 · GHSA-4rqf-grm6-vf75

free5GC: UDR nudr-dr DELETE amf-subscriptions panics on missing subsId when UE state exists (nil pointer dereference)

LOW 29

free5GC is an open-source implementation of the 5G core network.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0035 Published 2026-05-27 Fixed in 4.2.2, 1.4.3 CWE-476

TI-2026-32292 CVE-2026-44324 · GHSA-jqfc-gwj5-3w63

Incorrect type conversion in free5gc

MEDIUM 62

free5GC is an open-source implementation of the 5G core network.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0042 Published 2026-05-27 Fixed in 4.2.2, 1.4.3 CWE-704

TI-2026-32293 CVE-2026-44325 · GHSA-f8qv-7x5w-qr48

free5GC: NRF POST /oauth2/token structured-form parser type-confusion panic family (Reflect.Set on incompatible types)

HIGH 72

free5GC is an open-source implementation of the 5G core network.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00394 Published 2026-05-27 Fixed in 4.2.2, 1.4.3 CWE-20

TI-2026-32294 CVE-2026-44326 · GHSA-3p28-73q7-45xp

Missing authorization in free5gc

HIGH 80

free5GC is an open-source implementation of the 5G core network.

CVSS 3.1CRITICAL 9.4 Network No auth No interaction EPSS 0.00311 Published 2026-05-27 Fixed in 4.2.2 CWE-862

TI-2026-32295 CVE-2026-44327 · GHSA-cmpj-2x3g-m7g3

free5GC: NEF nnef-oam route group is unauthenticated; no-token requests reach the OAM handler

HIGH 82

free5GC is an open-source implementation of the 5G core network.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00311 Published 2026-05-27 Fixed in 4.2.2 CWE-306

TI-2026-32296 CVE-2026-44328 · GHSA-p9mg-74mg-cwwr

Missing authentication in free5gc

HIGH 75

free5GC is an open-source implementation of the 5G core network.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00324 Published 2026-05-27 Fixed in 4.2.2, 1.4.3 CWE-306

TI-2026-32297 CVE-2026-44329 · GHSA-3258-qmv8-frp3

free5GC: SMF UPI management interface lacks auth middleware; unauthenticated topology read/write requests reach handlers

HIGH 82

free5GC is an open-source implementation of the 5G core network.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00331 Published 2026-05-27 Fixed in 4.2.2, 1.4.3 CWE-306

TI-2026-32298 CVE-2026-44330 · GHSA-rwww-x45w-p52w

Incorrect authorization in free5gc

HIGH 82

free5GC is an open-source implementation of the 5G core network.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00287 Published 2026-05-27 Fixed in 4.2.2 CWE-863

TI-2026-32286 CVE-2026-44318 · GHSA-27ph-8q4f-h7m7

Race condition in free5gc

MEDIUM 62

free5GC is an open-source implementation of the 5G core network.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00332 Published 2026-05-27 Fixed in 4.2.2, 1.0.2 CWE-362

Vulnerabilities

Filters