Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Free5GC — Vulnerabilities & Security Advisories 43

All 43 CVE vulnerabilities found in Free5GC, with AI-generated Chinese analysis, references, and POCs.

This page aggregates security vulnerabilities associated with Free5GC, an open-source 5G Core network implementation, focusing specifically on software weaknesses and their impacts. It collects reported flaws, primarily concerning memory corruption, authentication bypasses, and logic errors within the network functions, covering disclosures from the project's public release through current maintenance cycles. Readers can use this resource to track vendor advisories, understand the technical nature of specific weakness classes affecting core network components, and review the product's complete vulnerability history to assess cumulative risk. The data is organized to facilitate rapid identification of recurring issues, such as improper input validation or privilege escalation paths, enabling security teams to prioritize patching efforts based on severity and exploitability. By centralizing these records, the page serves as a reference for developers and operations personnel to monitor remediation status and verify fixes across different versions of the Free5GC software stack.

Vendor: n/a

CVE ID Title CVSS Severity Published
CVE-2026-94043 Free5GC Gmm handler.go race condition CWE-362 5.3 Medium 2026-09-20
CVE-2026-47780 free5GC: UDR Improper ueId validation in free5GC EE subscription handlers allows arbitrary identifier persistence CWE-20 6.9 Medium 2026-09-15
CVE-2026-55785 free5GC AUSF uses non-constant-time authentication comparisons and logs XRES* in 5G-AKA CWE-208 3.7 Low 2026-08-28
CVE-2026-55784 free5GC AUSF authentication contexts can be overwritten by concurrent requests for the same SUPI CWE-362 7.5 High 2026-08-28
CVE-2026-55068 free5GC: NRF nnrf-nfm lacks NF Profile input validation — enables NF Registration Poisoning with arbitrary service endpoints CWE-20 9.3 Critical 2026-08-28
CVE-2026-53551 free5GC AUSF: null byte injection in supiOrSuci causes HTTP 500 internal service failure CWE-20 6.9 Medium 2026-07-31
CVE-2026-42081 free5GC: UE Security Capability bypass on NGAP PathSwitchRequest CWE-358 6.1 Medium 2026-05-27
CVE-2026-42082 free5GC: Missing Concurrent NAS SMC Validation During NGAP Handover CWE-358 3.7 Low 2026-05-27
CVE-2026-42083 free5GC: PCF Npcf_SMPolicyControl missing authentication middleware allows unauthenticated access to SM policy handlers and disclosure of subscriber SUPI CWE-862 8.2 High 2026-05-27
CVE-2026-42459 free5GC: Improper Input Validation and Generation of Error Message Containing Sensitive Information in github.com/free5gc/udm CWE-20 - - 2026-05-27
CVE-2026-44315 free5GC: NEF 3gpp-pfd-management API is unauthenticated; forged bearer tokens can create, read, and delete PFD transactions CWE-862 9.4 Critical 2026-05-27
CVE-2026-44316 free5GC: PCF npcf-smpolicycontrol POST /sm-policies panics on downstream UDR/OpenAPI 404 via nil pointer dereference CWE-476 7.5 High 2026-05-27
CVE-2026-44317 free5GC: PCF npcf-policyauthorization POST /app-sessions panics on suppFeat=1 with missing AfRoutReq via nil pointer dereference CWE-476 6.5 Medium 2026-05-27
CVE-2026-44319 free5GC: NEF crashes via logger.Fatal on PFD notification delivery failure (attacker-controlled notifyUri) CWE-20 7.5 High 2026-05-27
CVE-2026-44320 free5GC: NEF nnef-callback route group is unauthenticated; forged callback requests are accepted into the processing path CWE-306 7.3 High 2026-05-27
CVE-2026-44321 free5GC: SMF UPI POST /upi/v1/upNodesLinks exits the SMF process on overlapping UE pools (unauthenticated, reachable Fatalf) CWE-306 7.5 High 2026-05-27
CVE-2026-44322 free5GC: NEF 3gpp-pfd-management PATCH applications/{appId} panics on UDR access failure due to nil ProblemDetails dereference CWE-476 7.5 High 2026-05-27
CVE-2026-44323 free5GC: UDR nudr-dr DELETE amf-subscriptions panics on missing subsId when UE state exists (nil pointer dereference) CWE-476 4.3 Medium 2026-05-27
CVE-2026-44324 free5GC: UDR nudr-dr DELETE amf-subscriptions panics on missing UE state via nil interface type assertion (single authenticated request) CWE-704 6.5 Medium 2026-05-27
CVE-2026-44325 free5GC: NRF POST /oauth2/token structured-form parser type-confusion panic family (Reflect.Set on incompatible types) CWE-20 7.5 High 2026-05-27
CVE-2026-44326 free5GC: NEF 3gpp-traffic-influence API is unauthenticated; missing or forged bearer tokens can create, read, patch, and delete subscriptions CWE-862 9.4 Critical 2026-05-27
CVE-2026-44327 free5GC: NEF nnef-oam route group is unauthenticated; no-token requests reach the OAM handler CWE-306 10.0 Critical 2026-05-27
CVE-2026-44328 free5GC: SMF UPI DELETE /upi/v1/upNodesLinks/{ref} panics on AN-node deletion via nil UPF dereference; unauthenticated, state-mutating CWE-306 8.2 High 2026-05-27
CVE-2026-44329 free5GC: SMF UPI management interface lacks auth middleware; unauthenticated topology read/write requests reach handlers CWE-306 10.0 Critical 2026-05-27
CVE-2026-44330 free5GC: NEF nnef-pfdmanagement API is unauthenticated; forged bearer tokens can read PFD data and create/delete PFD subscriptions CWE-863 10.0 Critical 2026-05-27
CVE-2026-44318 free5GC: BSF concurrent PUT /nbsf-management/v1/subscriptions/{subId} crashes the BSF process via concurrent map read/write on Subscriptions CWE-362 6.5 Medium 2026-05-27
CVE-2026-40249 free5gc UDR fail-open request handling in PolicyDataSubsToNotifySubsIdPut may allow unintended subscription updates after input errors CWE-754 9.1AI Critical AI 2026-04-16
CVE-2026-40248 free5gc UDR improper path validation allows unauthenticated creation and modification of Traffic Influence Subscriptions CWE-285 7.5AI High AI 2026-04-16
CVE-2026-40247 free5gc UDR improper path validation allows unauthenticated access to Traffic Influence Subscriptions CWE-285 5.3AI Medium AI 2026-04-16
CVE-2026-40246 free5gc UDR improper path validation allows unauthenticated deletion of Traffic Influence Subscriptions CWE-285 5.3AI Medium AI 2026-04-16

All 43 known CVE vulnerabilities affecting Free5GC with full Chinese analysis, references, and POCs where available.