Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
108 results · page 2 of 3
Apr 16, 2026free5GC is an open-source implementation of the 5G core network.CVE-2026-40246 · Other software · free5gc · reported by GitHubHigh 8.7
free5GC is an open-source implementation of the 5G core network. In versions 1.4.2 and below of the UDR service, the handler for deleting Traffic Influence Subscriptions checks whether the influenceId path segment equals subs-to-notify, but does not return after sending the HTTP 404 response when validation fails. Execution continues and the subscription is deleted regardless. An unauthenticated attacker with access to the 5G Service Based Interface can delete arbitrary Traffic Influence Subscriptions by supplying any value for the influenceId path segment, while the API misleadingly returns a 404 Not Found response. A patched version was not available at the time of publication.
- Product
- free5gc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2026Free5GC is an open-source Linux Foundation project for 5th generation (5G) mobile core networks.CVE-2026-40245 · Other software · free5gc · reported by GitHubHigh 7.5
Free5GC is an open-source Linux Foundation project for 5th generation (5G) mobile core networks. Versions 4.2.1 and below contain an information disclosure vulnerability in the UDR (Unified Data Repository) service. The handler for GET /nudr-dr/v2/application-data/influenceData/subs-to-notify sends an HTTP 400 error response when required query parameters are missing but does not return afterward. Execution continues into the processor function, which queries the data repository and appends the full list of Traffic Influence Subscriptions, including SUPI/IMSI values, to the response body. An unauthenticated attacker with network access to the 5G Service Based Interface can retrieve stored subscriber identifiers with a single parameterless HTTP GET request. The SUPI is the most sensitive subscriber identifier in 5G networks, and its exposure undermines the privacy guarantees of the 3GPP SUCI concealment mechanism at the core network level. A similar bypass exists when sending a malformed snssai parameter due to the same missing return pattern.
- Product
- free5gc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026A vulnerability was identified in Free5GC 4.2.0.CVE-2026-5661 · Other software · reported by VulDBMedium 5.5
A vulnerability was identified in Free5GC 4.2.0. This affects an unknown function of the component NGSetupRequest Handler. Such manipulation leads to denial of service. The attack may be launched remotely. The exploit is publicly available and might be used.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2026A vulnerability has been found in Free5GC 4.2.0.CVE-2026-5360 · Other software · Free5gc · reported by VulDBLow 2.9
A vulnerability has been found in Free5GC 4.2.0. The affected element is an unknown function of the component aper. Such manipulation leads to type confusion. The attack may be launched remotely. This attack is characterized by high complexity. The exploitability is described as difficult. The exploit has been disclosed to the public and may be used. The name of the patch is 26205eb01705754b7b902ad6c4b613c96c881e29. It is best practice to apply a patch to resolve this issue.
- Product
- Free5gc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2026An issue in Free5GC v.4.2.0 and before allows a remote attacker to cause a denial of service via the function HandleAuthenticationFailure of the component AMFCVE-2026-30653 · Other software · Free5gc · reported by MITREHigh 7.5
An issue in Free5GC v.4.2.0 and before allows a remote attacker to cause a denial of service via the function HandleAuthenticationFailure of the component AMF
- Product
- Free5gc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2026A weakness has been identified in Free5GC 4.1.0.CVE-2026-4531 · Other software · reported by VulDBMedium 6.9
A weakness has been identified in Free5GC 4.1.0. Affected is the function HandleRegistrationComplete of the file internal/gmm/handler.go of the component AMF. Executing a manipulation can lead to denial of service. The attack may be performed from remote. This patch is called 52e9386401ce56ea773c5aa587d4cdf7d53da799. It is best practice to apply a patch to resolve this issue.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2026Free5GC is an open-source Linux Foundation project for 5th generation (5G) mobile core networks.CVE-2026-33192 · Other software · free5gc · reported by GitHubHigh 8.7
Free5GC is an open-source Linux Foundation project for 5th generation (5G) mobile core networks. In versions prior to 1.4.2, the UDM incorrectly converts a downstream 400 Bad Request (from UDR) into a 500 Internal Server Error when handling PATCH requests with an empty supi path parameter. Additionally, the UDM incorrectly translates the PATCH method to PUT when forwarding to UDR, indicating a deeper architectural issue. This leaks internal error handling behavior, making it difficult for clients to distinguish between client-side errors and server-side failures. The issue has been patched in version 1.4.2.
- Product
- free5gc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2026Free5GC is an open-source Linux Foundation project for 5th generation (5G) mobile core networks.CVE-2026-33191 · Other software · free5gc · reported by GitHubHigh 8.7
Free5GC is an open-source Linux Foundation project for 5th generation (5G) mobile core networks. Versions prior to 1.4.2 are vulnerable to null byte injection in URL path parameters. A remote attacker can inject null bytes (URL-encoded as %00) into the supi path parameter of the UDM's Nudm_SubscriberDataManagement API. This causes URL parsing failure in Go's net/url package with the error "invalid control character in URL", resulting in a 500 Internal Server Error. This null byte injection vulnerability can be exploited for denial of service attacks. When the supi parameter contains null characters, the UDM attempts to construct a URL for UDR that includes these control characters. Go's URL parser rejects them, causing the request to fail with 500 instead of properly validating input and returning 400 Bad Request. This issue has been fixed in version 1.4.2.
- Product
- free5gc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2026Free5GC is an open-source Linux Foundation project for 5th generation (5G) mobile core networks.CVE-2026-33065 · Other software · free5gc · reported by GitHubMedium 6.9
Free5GC is an open-source Linux Foundation project for 5th generation (5G) mobile core networks. In versions prior to 1.4.2, the UDM incorrectly converts a downstream 400 Bad Request (from UDR) into a 500 Internal Server Error when handling DELETE requests with an empty supi path parameter. This leaks internal error handling behavior and makes it difficult for clients to distinguish between client-side errors and server-side failures. When a client sends a DELETE request with an empty supi (e.g., double slashes // in URL path), the UDM forwards the malformed request to UDR, which correctly returns 400. However, UDM propagates this as 500 SYSTEM_FAILURE instead of returning the appropriate 400 error to the client. This violates REST API best practices for DELETE operations. The issue has been patched in version 1.4.2.
- Product
- free5gc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2026Free5GC is an open-source Linux Foundation project for 5th generation (5G) mobile core networks.CVE-2026-33064 · Other software · free5gc · reported by GitHubHigh 8.7
Free5GC is an open-source Linux Foundation project for 5th generation (5G) mobile core networks. Versions prior to 1.4.2 are vulnerable to procedure panic caused by Nil Pointer Dereference in the /sdm-subscriptions endpoint. A remote attacker can cause the UDM service to panic and crash by sending a crafted POST request to the /sdm-subscriptions endpoint with a malformed URL path containing path traversal sequences (../) and a large JSON payload. The DataChangeNotificationProcedure function in notifier.go attempts to access a nil pointer without proper validation, causing a complete service crash with "runtime error: invalid memory address or nil pointer dereference". Exploitation would result in UDM functionality disruption until recovery by restart. This issue has been fixed in version 1.4.2.
- Product
- free5gc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 19, 2026free5GC is an open source 5G core network.CVE-2026-33063 · Other software · free5gc · reported by GitHubHigh 8.7
free5GC is an open source 5G core network. free5GC AUSF prior to version 1.4.2 has is an Improper Null Check vulnerability leading to Denial of Service. All deployments of free5GC v4.0.1 using the AUSF UE authentication service (`/nausf-auth/v1/ue-authentications` endpoint) are affected. A remote attacker can cause the AUSF service to panic and crash by sending a crafted UE authentication request that triggers a nil interface conversion in the `GetSupiFromSuciSupiMap` function. This results in complete denial of service for the AUSF authentication service. The `GetSupiFromSuciSupiMap` function attempts to perform an interface conversion from `interface{}` to `*context.SuciSupiMap` without checking if the underlying value is nil. When `SuciSupiMap` is nil, the code panics with "interface conversion: interface {} is nil, not *context.SuciSupiMap". free5GC AUSF version 1.4.2 patches the issue. There is no direct workaround at the application level. The recommendation is to apply the provided patch or restrict access to the AUSF API to trusted sources only.
- Product
- ausf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 19, 2026free5GC is an open source 5G core network.CVE-2026-33062 · Other software · free5gc · reported by GitHubHigh 8.7
free5GC is an open source 5G core network. free5GC NRF prior to version 1.4.2 has an Improper Input Validation vulnerability leading to Denial of Service. All deployments of free5GC using the NRF discovery service are affected. The `EncodeGroupId` function attempts to access array indices [0], [1], [2] without validating the length of the split data. When the parameter contains insufficient separator characters, the code panics with "index out of range". A remote attacker can cause the NRF service to panic and crash by sending a crafted HTTP GET request with a malformed `group-id-list` parameter. This results in complete denial of service for the NRF discovery service. free5GC NRF version 1.4.2 fixes the issue. There is no direct workaround at the application level. The recommendation is to apply the provided patch or restrict access to the NRF API to trusted sources only.
- Product
- nrf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 19, 2026free5GC is an open source 5G core network.CVE-2026-32937 · Other software · free5gc · reported by GitHubHigh 7.1
free5GC is an open source 5G core network. free5GC CHF prior to version 1.2.2 has an out-of-bounds slice access vulnerability in the CHF `nchf-convergedcharging` service. A valid authenticated request to PUT `/nchf-convergedcharging/v3/recharging/:ueId?ratingGroup=...` can trigger a server-side panic in `github.com/free5gc/chf/internal/sbi.(*Server).RechargePut(...)` due to an out-of-range slice access. In the reported runtime, Gin recovery converts the panic into HTTP 500, but the recharge path remains remotely panic-triggerable and can be abused repeatedly to degrade recharge functionality and flood logs. In deployments without equivalent recovery handling, this panic may cause more severe service disruption. free5GC CHF patches the issue. Some workarounds are available: Restrict access to the `nchf-convergedcharging` recharge endpoint to strictly trusted NF callers only; apply rate limiting or network ACLs in front of the CHF SBI interface to reduce repeated panic-trigger attempts; if the recharge API is not required, temporarily disable or block external reachability to this route; and/or ensure panic recovery, monitoring, and alerting are enabled.
- Product
- chf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2026free5GC UDR is the user data repository (UDR) for free5GC, an an open-source project for 5th generation (5G) mobile core networks.CVE-2026-27643 · Other software · free5gc · reported by GitHubMedium 6.6
free5GC UDR is the user data repository (UDR) for free5GC, an an open-source project for 5th generation (5G) mobile core networks. In versions up to and including 1.4.1, the NEF component reliably leaks internal parsing error details (e.g., invalid character 'n' after top-level value) to remote clients, which can aid attackers in service fingerprinting. All deployments of free5GC using the Nnef_PfdManagement service may be affected. free5gc/udr pull request 56 contains a patch for the issue. There is no direct workaround at the application level. The recommendation is to apply the provided patch.
- Product
- udr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2026free5gc UDM provides Unified Data Management (UDM) for free5GC, an open-source project for 5th generation (5G) mobile core networks.CVE-2026-27642 · Other software · free5gc · reported by GitHubMedium 6.6
free5gc UDM provides Unified Data Management (UDM) for free5GC, an open-source project for 5th generation (5G) mobile core networks. In versions up to and including 1.4.1, remote attackers can inject control characters (e.g., %00) into the supi parameter, triggering internal URL parsing errors (net/url: invalid control character). This exposes system-level error details and can be used for service fingerprinting. All deployments of free5GC using the UDM Nudm_UEAU service may be affected. free5gc/udm pull request 75 contains a fix for the issue. No direct workaround is available at the application level. Applying the official patch is recommended.
- Product
- udm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2026free5GC SMF provides Session Management Function for free5GC, an open-source project for 5th generation (5G) mobile core networks.CVE-2026-26025 · Other software · free5gc · reported by GitHubMedium 6.6
free5GC SMF provides Session Management Function for free5GC, an open-source project for 5th generation (5G) mobile core networks. In versions up to and including 1.4.1, SMF panics and terminates when processing a malformed PFCP SessionReportRequest on the PFCP (UDP/8805) interface. No known upstream fix is available, but some workarounds are available. ACL/firewall the PFCP interface so only trusted UPF IPs can reach SMF (reduce spoofing/abuse surface); drop/inspect malformed PFCP SessionReportRequest messages at the network edge where feasible, and/or add recover() around PFCP handler dispatch to avoid whole-process termination (mitigation only).
- Product
- smf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2026free5GC SMF provides Session Management Function for free5GC, an open-source project for 5th generation (5G) mobile core networks.CVE-2026-26024 · Other software · free5gc · reported by GitHubMedium 6.6
free5GC SMF provides Session Management Function for free5GC, an open-source project for 5th generation (5G) mobile core networks. In versions up to and including 1.4.1, SMF panics and terminates when processing a malformed PFCP SessionReportRequest on the PFCP (UDP/8805) interface. No known upstream fix is available, but some workarounds are available. ACL/firewall the PFCP interface so only trusted UPF IPs can reach SMF (reduce spoofing/abuse surface); drop/inspect malformed PFCP SessionReportRequest messages at the network edge where feasible, and/or add recover() around PFCP handler dispatch to avoid whole-process termination (mitigation only).
- Product
- smf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2026free5GC SMF provides Session Management Function for free5GC, an open-source project for 5th generation (5G) mobile core networks.CVE-2026-25501 · Other software · free5gc · reported by GitHubMedium 6.6
free5GC SMF provides Session Management Function for free5GC, an open-source project for 5th generation (5G) mobile core networks. In versions up to and including 1.4.1, SMF panics due to nil pointer dereference and the SMF process terminates. This is triggered by a malformed PFCP SessionReportRequest on the SMF PFCP (UDP/8805) interface. No known upstream fix is available, but some workarounds are available. ACL/firewall the PFCP interface so only trusted UPF IPs can reach SMF (reduce spoofing/abuse surface); drop/inspect malformed PFCP SessionReportRequest messages at the network edge where feasible, and/or add recover() around PFCP handler dispatch to avoid whole-process termination (mitigation only).
- Product
- smf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2026free5GC is an open-source project for 5th generation (5G) mobile core networks.CVE-2025-69253 · Other software · free5gc · reported by GitHubMedium 6.6
free5GC is an open-source project for 5th generation (5G) mobile core networks. Versions up to and including 1.4.1 of the User Data Repository are affected by Improper Error Handling with Information Exposure. The NEF component reliably leaks internal parsing error details (e.g., invalid character 'n' after top-level value) to remote clients, which can aid attackers in service fingerprinting. All deployments of free5GC using the Nnef_PfdManagement service may be vulnerable. free5gc/udr pull request 56 contains a patch. No direct workaround is available at the application level. Applying the official patch is recommended.
- Product
- udr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2026free5gc UDM provides Unified Data Management (UDM) for free5GC, an open-source project for 5th generation (5G) mobile core networks.CVE-2025-69252 · Other software · free5gc · reported by GitHubMedium 6.6
free5gc UDM provides Unified Data Management (UDM) for free5GC, an open-source project for 5th generation (5G) mobile core networks. Versions up to and including 1.4.1 have a NULL Pointer Dereference vulnerability. Remote unauthenticated attackers can trigger a service panic (Denial of Service) by sending a crafted PUT request with an unexpected ueId, crashing the UDM service. All deployments of free5GC using the UDM component may be affected. free5gc/udm pull request 76 contains a fix for the issue. No direct workaround is available at the application level. Applying the official patch is recommended.
- Product
- udm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2026free5gc UDM provides Unified Data Management (UDM) for free5GC, an open-source project for 5th generation (5G) mobile core networks.CVE-2025-69251 · Other software · free5gc · reported by GitHubMedium 6.6
free5gc UDM provides Unified Data Management (UDM) for free5GC, an open-source project for 5th generation (5G) mobile core networks. In versions up to and including 1.4.1, remote attackers can inject control characters (e.g., %00) into the ueId parameter, triggering internal URL parsing errors (net/url: invalid control character). This exposes system implementation details and can aid in service fingerprinting. All deployments of free5GC using the UDM Nudm_UECM service may be affected. free5gc/udm pull request 76 contains a fix for the issue. No direct workaround is available at the application level. Applying the official patch is recommended.
- Product
- udm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2026free5gc UDM provides Unified Data Management (UDM) for free5GC, an open-source project for 5th generation (5G) mobile core networks.CVE-2025-69250 · Other software · free5gc · reported by GitHubMedium 6.6
free5gc UDM provides Unified Data Management (UDM) for free5GC, an open-source project for 5th generation (5G) mobile core networks. In versions up to and including 1.4.1, the service reliably leaks detailed internal error messages (e.g., strconv.ParseInt parsing errors) to remote clients when processing invalid pduSessionId inputs. This exposes implementation details and can be used for service fingerprinting. All deployments of free5GC using the UDM Nudm_UECM DELETE service may be vulnerable. free5gc/udm pull request 76 contains a fix for the issue. No direct workaround is available at the application level. Applying the official patch is recommended.
- Product
- udm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2026free5GC is an open-source project for 5th generation (5G) mobile core networks.CVE-2025-69248 · Other software · free5gc · reported by GitHubMedium 6.6
free5GC is an open-source project for 5th generation (5G) mobile core networks. Versions up to and including 1.4.1 of free5GC's AMF service have a Buffer Overflow vulnerability leading to Denial of Service. Remote unauthenticated attackers can crash the AMF service by sending a specially crafted NAS Registration Request with a malformed 5GS Mobile Identity, causing complete denial of service for the 5G core network. All deployments of free5GC using the AMF component may be affected. Pull request 43 of the free5gc/nas repo contains a fix. No direct workaround is available at the application level. Applying the official patch is recommended.
- Product
- amf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2026free5GC go-upf is the User Plane Function (UPF) implementation for 5G networks that is part of the free5GC project.CVE-2025-69247 · Other software · free5gc · reported by GitHubLow 2.7
free5GC go-upf is the User Plane Function (UPF) implementation for 5G networks that is part of the free5GC project. Versions prior to 1.2.8 have a Heap-based Buffer Overflow (CWE-122) vulnerability leading to Denial of Service. Remote attackers can crash the UPF network element by sending a specially crafted PFCP Session Modification Request with an invalid SDF Filter length field. This causes a heap buffer overflow, resulting in complete service disruption for all connected UEs and potential cascading failures affecting the SMF. All deployments of free5GC using the UPF component may be affected. Version 1.2.8 of go-upf contains a fix.
- Product
- go-upf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2026free5GC is an open-source project for 5th generation (5G) mobile core networks.CVE-2025-69232 · Other software · free5gc · reported by GitHubLow 2.7
free5GC is an open-source project for 5th generation (5G) mobile core networks. free5GC go-upf versions up to and including 1.2.6, corresponding to free5gc smf up to and including 1.4.0, have an Improper Input Validation and Protocol Compliance vulnerability leading to Denial of Service. Remote attackers can disrupt core network functionality by sending a malformed PFCP Association Setup Request. The UPF incorrectly accepts it, entering an inconsistent state that causes subsequent legitimate requests to trigger SMF reconnection loops and service degradation. All deployments of free5GC using the UPF and SMF components may be affected. As of time of publication, a fix is in development but not yet available. No direct workaround is available at the application level. Applying the official patch, once released, is recommended.
- Product
- go-upf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2026free5GC UDR is the user data repository (UDR) for free5GC, an an open-source project for 5th generation (5G) mobile core networks.CVE-2025-69208 · Other software · free5gc · reported by GitHubLow 2.7
free5GC UDR is the user data repository (UDR) for free5GC, an an open-source project for 5th generation (5G) mobile core networks. Versions prior to 1.4.1 contain an Improper Error Handling vulnerability with Information Exposure. All deployments of free5GC using the Nnef_PfdManagement service may be affected. The NEF component reliably leaks internal parsing errors (e.g., invalid character 'n' after top-level value) to remote clients. This can aid attackers in fingerprinting server software and logic flows. Version 1.4.1 fixes the issue. There is no direct workaround at the application level. The recommended mitigation is to apply the provided patch.
- Product
- udr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 15, 2026A vulnerability has been found in Free5GC up to 4.1.0.CVE-2026-2525 · Other software · Free5gc · reported by VulDBMedium 5.5
A vulnerability has been found in Free5GC up to 4.1.0. This affects an unknown function of the component PFCP UDP Endpoint. Such manipulation leads to denial of service. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- Free5gc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2026An improper input validation and protocol compliance vulnerability in free5GC v4.0.1 allows remote attackers to cause a denial of service.CVE-2025-70123 · Other software · Free5gc · reported by MITREHigh 7.5
An improper input validation and protocol compliance vulnerability in free5GC v4.0.1 allows remote attackers to cause a denial of service. The UPF incorrectly accepts a malformed PFCP Association Setup Request, violating 3GPP TS 29.244. This places the UPF in an inconsistent state where a subsequent valid PFCP Session Establishment Request triggers a cascading failure, disrupting the SMF connection and causing service degradation.
- Product
- Free5gc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2026A heap buffer overflow vulnerability in the UPF component of free5GC v4.0.1 allows remote attackers to cause a denial of service via a crafted PFCP Session ModiCVE-2025-70122 · Other software · Free5gc · reported by MITREHigh 7.5
A heap buffer overflow vulnerability in the UPF component of free5GC v4.0.1 allows remote attackers to cause a denial of service via a crafted PFCP Session Modification Request. The issue occurs in the SDFFilterFields.UnmarshalBinary function (sdf-filter.go) when processing a declared length that exceeds the actual buffer capacity, leading to a runtime panic and UPF crash.
- Product
- Free5gc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2026An array index out of bounds vulnerability in the AMF component of free5GC v4.0.1 allows remote attackers to cause a denial of service via a crafted 5GS Mobile CVE-2025-70121 · Other software · Free5gc · reported by MITREHigh 7.5
An array index out of bounds vulnerability in the AMF component of free5GC v4.0.1 allows remote attackers to cause a denial of service via a crafted 5GS Mobile Identity in a NAS Registration Request message. The issue occurs in the GetSUCI method (NAS_MobileIdentity5GS.go) when accessing index 5 of a 5-element array, leading to a runtime panic and AMF crash.
- Product
- Free5gc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2026A weakness has been identified in Free5GC up to 4.1.0.CVE-2026-1976 · Other software · Free5gc · reported by VulDBMedium 5.5
A weakness has been identified in Free5GC up to 4.1.0. Affected is the function SessionDeletionResponse of the component SMF. This manipulation causes null pointer dereference. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. It is suggested to install a patch to address this issue.
- Product
- Free5gc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2026A security flaw has been discovered in Free5GC up to 4.1.0.CVE-2026-1975 · Other software · Free5gc · reported by VulDBMedium 5.5
A security flaw has been discovered in Free5GC up to 4.1.0. This impacts the function identityTriggerType of the file pfcp_reports.go. The manipulation results in null pointer dereference. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. Applying a patch is advised to resolve this issue.
- Product
- Free5gc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2026A vulnerability was identified in Free5GC up to 4.1.0.CVE-2026-1974 · Other software · Free5gc · reported by VulDBMedium 5.5
A vulnerability was identified in Free5GC up to 4.1.0. This affects the function ResolveNodeIdToIp of the file internal/sbi/processor/datapath.go of the component SMF. The manipulation leads to denial of service. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. It is recommended to apply a patch to fix this issue.
- Product
- Free5gc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2026A vulnerability was determined in Free5GC up to 4.1.0.CVE-2026-1973 · Other software · Free5gc · reported by VulDBMedium 5.5
A vulnerability was determined in Free5GC up to 4.1.0. The impacted element is the function establishPfcpSession of the component SMF. Executing a manipulation can lead to null pointer dereference. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. It is best practice to apply a patch to resolve this issue.
- Product
- Free5gc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 1, 2026A vulnerability has been found in Free5GC pcf up to 1.4.1.CVE-2026-1739 · Other software · Free5GC · reported by VulDBMedium 5.5
A vulnerability has been found in Free5GC pcf up to 1.4.1. This affects the function HandleCreateSmPolicyRequest of the file internal/sbi/processor/smpolicy.go. The manipulation leads to null pointer dereference. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is df535f5524314620715e842baf9723efbeb481a7. Applying a patch is the recommended action to fix this issue.
- Product
- pcf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2026A vulnerability was found in Free5GC SMF up to 4.1.0.CVE-2026-1684 · Other software · Free5GC · reported by VulDBMedium 6.9
A vulnerability was found in Free5GC SMF up to 4.1.0. Affected by this issue is the function HandleReports of the file /internal/context/pfcp_reports.go of the component PFCP UDP Endpoint. The manipulation results in denial of service. The attack can be executed remotely. It is advisable to implement a patch to correct this issue.
- Product
- SMF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2026A vulnerability has been found in Free5GC SMF up to 4.1.0.CVE-2026-1683 · Other software · Free5GC · reported by VulDBMedium 5.5
A vulnerability has been found in Free5GC SMF up to 4.1.0. Affected by this vulnerability is the function HandlePfcpSessionReportRequest of the file internal/pfcp/handler/handler.go of the component PFCP. The manipulation leads to denial of service. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. To fix this issue, it is recommended to deploy a patch.
- Product
- SMF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2026A flaw has been found in Free5GC SMF up to 4.1.0.CVE-2026-1682 · Other software · Free5GC · reported by VulDBMedium 5.5
A flaw has been found in Free5GC SMF up to 4.1.0. Affected is the function HandlePfcpAssociationReleaseRequest of the file internal/pfcp/handler/handler.go of the component PFCP UDP Endpoint. Executing a manipulation can lead to null pointer dereference. The attack may be launched remotely. The exploit has been published and may be used. A patch should be applied to remediate this issue.
- Product
- SMF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2026Null pointer dereference in free5gc pcf 1.4.0 in file internal/sbi/processor/ampolicy.go in function HandleDeletePoliciesPolAssoId.CVE-2025-66720 · Other software · Free5gc · reported by MITREHigh 7.5
Null pointer dereference in free5gc pcf 1.4.0 in file internal/sbi/processor/ampolicy.go in function HandleDeletePoliciesPolAssoId.
- Product
- PCF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2026An issue was discovered in Free5gc NRF 1.4.0.CVE-2025-66719 · Other software · Free5gc · reported by MITRECritical 9.1
An issue was discovered in Free5gc NRF 1.4.0. In the access-token generation logic of free5GC, the AccessTokenScopeCheck() function in file internal/sbi/processor/access_token.go bypasses all scope validation when the attacker uses a crafted targetNF value. This allows attackers to obtain an access token with any arbitrary scope.
- Product
- NRF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2025The free5GC UPF suffers from a lack of bounds checking on the SEID when processing PFCP Session Deletion Requests.CVE-2025-65562 · Other software · Free5gc · reported by MITREHigh 7.5
The free5GC UPF suffers from a lack of bounds checking on the SEID when processing PFCP Session Deletion Requests. An unauthenticated remote attacker can send a request with a very large SEID (e.g., 0xFFFFFFFFFFFFFFFF) that causes an integer conversion/underflow in LocalNode.DeleteSess() / LocalNode.Sess() when a uint64 SEID is converted to int and used in index arithmetic. This leads to a negative index into n.sess and a Go runtime panic, resulting in a denial of service (UPF crash). The issue has been reproduced on free5GC v4.1.0 with crashes observed in the session lookup/deletion path in internal/pfcp/node.go; other versions may also be affected. No authentication is required.
- Product
- Free5gc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2025An issue was discovered in function LocalNode.Sess in free5GC 4.1.0 allowing attackers to cause a denial of service or other unspecified impacts via crafted heaCVE-2025-65561 · Other software · Free5gc · reported by MITREHigh 7.5
An issue was discovered in function LocalNode.Sess in free5GC 4.1.0 allowing attackers to cause a denial of service or other unspecified impacts via crafted header Local SEID to the PFCP Session Modification Request.
- Product
- Free5gc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 24, 2025An issue was discovered in Free5GC v4.0.0 and v4.0.1 allowing an attacker to cause a denial of service via crafted POST request to the Nnssf_NSSAIAvailability ACVE-2025-60638 · Other software · Free5gc · reported by MITREHigh 7.5
An issue was discovered in Free5GC v4.0.0 and v4.0.1 allowing an attacker to cause a denial of service via crafted POST request to the Nnssf_NSSAIAvailability API.
- Product
- Free5gc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 24, 2025An issue was discovered in Free5GC v4.0.0 and v4.0.1 allowing an attacker to cause a denial of service via the Nudm_SubscriberDataManagement API.CVE-2025-60633 · Other software · Free5gc · reported by MITREMedium 6.5
An issue was discovered in Free5GC v4.0.0 and v4.0.1 allowing an attacker to cause a denial of service via the Nudm_SubscriberDataManagement API.
- Product
- Free5gc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 24, 2025An issue was discovered in Free5GC v4.0.0 and v4.0.1 allowing an attacker to cause a denial of service via crafted POST request to the Npcf_BDTPolicyControl APICVE-2025-60632 · Other software · Free5gc · reported by MITREMedium 6.5
An issue was discovered in Free5GC v4.0.0 and v4.0.1 allowing an attacker to cause a denial of service via crafted POST request to the Npcf_BDTPolicyControl API.
- Product
- Free5gc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2025free5gc v4.1.0 and before is vulnerable to Buffer Overflow.CVE-2025-63679 · Other software · Free5gc · reported by MITREHigh 7.5
free5gc v4.1.0 and before is vulnerable to Buffer Overflow. When AMF receives an UplinkRANConfigurationTransfer NGAP message from a gNB, the AMF process crashes.
- Product
- Free5gc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Sep 23, 2025Free5gc 4.0.1 is vulnerable to Buffer Overflow.CVE-2025-56394 · Other software · Free5gc · reported by MITREHigh 7.5
Free5gc 4.0.1 is vulnerable to Buffer Overflow. The AMF incorrectly validates the 5GS mobile identity, resulting in slice reference overflow.
- Product
- Free5gc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
May 29, 2025Buffer Overflow vulnerability in Free5gc v.4.0.0 allows a remote attacker to cause a denial of service via the AMF, NGAP, security.go, handler_generated.go, hanCVE-2025-29632 · Other software · Free5gc · reported by MITREMedium 5.4
Buffer Overflow vulnerability in Free5gc v.4.0.0 allows a remote attacker to cause a denial of service via the AMF, NGAP, security.go, handler_generated.go, handleInitialUEMessageMain, DecodePlainNasNoIntegrityCheck, GetSecurityHeaderType components
- Product
- Free5gc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 22, 2023An issue was discovered in free5GC version 3.3.0, allows remote attackers to execute arbitrary code and cause a denial of service (DoS) on AMF component via craCVE-2023-49391 · Other software · Free5gc · reported by MITREHigh 7.5
An issue was discovered in free5GC version 3.3.0, allows remote attackers to execute arbitrary code and cause a denial of service (DoS) on AMF component via crafted NGAP message.
- Product
- Free5gc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2023An issue in Free5gc v.3.3.0 allows a local attacker to cause a denial of service via the free5gc-compose component.CVE-2023-47025 · Other software · Free5gc · reported by MITREMedium 5.5
An issue in Free5gc v.3.3.0 allows a local attacker to cause a denial of service via the free5gc-compose component.
- Product
- Free5gc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.