CVE-2026-55785

free5GC's AUSF component (prior to version 1.4.5) performs 5G-AKA cryptographic authentication comparisons in ue_authentication.go using non-constant-time helpers: strings.EqualFold for RES*/XRES* and bytes.Equal for AT_MAC/XMAC. Additionally, the expected XRES* value is logged at INFO level befo...

CVE-2026-55785 free5GC AUSF uses non-constant-time authentication comparisons and logs XRES* in 5G-AKA

free5GC is an open-source implementation of the 5G core network. Prior to 1.4.5, the AUSF component performs cryptographic authentication comparisons in internal/sbi/processor/ueauthentication.go with ordinary equality helpers. Auth5gAkaComfirmRequestProcedure compares RES and XRES with...

CVE-2026-55784 free5GC AUSF authentication contexts can be overwritten by concurrent requests for the same SUPI

free5GC is an open-source implementation of the 5G core network. In version 1.4.4 and earlier, the AUSF component stores per-subscriber authentication state in a global sync.Map named AUSFContext.UePool in internal/context/context.go, keyed only by SUPI. Every request handled by...

CVE-2026-55784

free5GC is an open-source 5G core network implementation. In versions 1.4.4 and earlier , the AUSF component stores per-subscriber authentication state in a global sync.Map keyed only by SUPI . Because each request unconditionally replaces the active context for that SUPI, an attacker with access...

CVE-2026-55068

free5GC is an open-source implementation of the 5G core network. In 4.2.2 and earlier, the NRF RegisterNFInstance handler at PUT /nnrf-nfm/v1/nf-instances/nfInstanceID accepts NF Profiles without enforcing UUID format, nfStatus enum values, heartBeatTimer ranges, mandatory profile fields, or...

CVE-2026-55068

creationtimestamp| type| source ---|---|--- 2026-08-28 17:33:07+00:00| seen| https://gist.github.com/alon710/6afc3d410daf4fc14ca37ccd754d5535 2026-08-28 18:35:23+00:00| published-proof-of-concept| https://github.com/free5gc/free5gc/security/advisories/GHSA-x8mj-6p3q-g5pp 2026-08-28 22:07:40+00:00...

CVE-2026-55068 free5GC: NRF nnrf-nfm lacks NF Profile input validation — enables NF Registration Poisoning with arbitrary service endpoints

free5GC is an open-source implementation of the 5G core network. In 4.2.2 and earlier, the NRF RegisterNFInstance handler at PUT /nnrf-nfm/v1/nf-instances/nfInstanceID accepts NF Profiles without enforcing UUID format, nfStatus enum values, heartBeatTimer ranges, mandatory profile fields, or...

CVE-2026-55068

free5GC (open-source 5G core network) version 4.2.2 and earlier is vulnerable to NF Registration Poisoning in the NRF component. The RegisterNFInstance handler (PUT /nnrf-nfm/v1/nf-instances/{nfInstanceID}) accepts NF profile bodies without enforcing 3GPP TS 29.510 constraints for UUID format, nf...

PT-2026-83369

Name of the Vulnerable Software and Affected Versions free5GC versions 1.4.4 and earlier Description The AUSF component stores per-subscriber authentication state in a global sync.Map named AUSFContext.UePool within internal/context/context.go, using only the SUPI as a key. Requests processed by...

CVE-2026-55068: Improper Input Validation

free5GC is an open-source implementation of the 5G core network. In 4.2.2 and earlier, the NRF RegisterNFInstance handler at PUT /nnrf-nfm/v1/nf-instances/nfInstanceID accepts NF Profiles without enforcing UUID format, nfStatus enum values, heartBeatTimer ranges, mandatory profile fields, or...

Are We Shooting Flies with Cannons? Trade-Off Analysis for AI-Based 5G Intrusion Detection

The increasing adoption of Artificial Intelligence AI in network intrusion detection raises the question of whether complex and computationally expensive models are justified for this task. In this work, we investigate the trade-off between detection performance and computational cost for intrusi...

EUVD-2026-67108

An issue in the CreateUEContext handler component of free5gc v4.1.0 allows attackers to cause a Denial of Service DoS via supplying a crafted request...

CERTIoT-6G: Continuous Cybersecurity Certification for IoT Devices in 5G/6G Networks

The massive adoption of Internet of Things IoT devices across critical domains such as healthcare, smart cities, industrial automation, and critical infrastructure introduces significant cybersecurity and regulatory challenges. Current and forthcoming European regulations, including the Cyber...

CVE-2026-71676

Buffer Overflow vulnerability in Open5GS v.2.7.0 allows a remote attacker to cause a denial of service via the NAS 5GS decoder chain, triggered when the message type byte of a NAS PDU is mutated...

HPESBNW05119 rev.1 - Multiple Vulnerabilities in HPE Aruba Networking Private 5G Core

Potential Security Impact: Remote: Access Restriction Bypass, Authentication Bypass, Escalation of Privilege, Gain Unauthorized Access SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Aruba Networking Private 5G Core 1.26.1.2 and prior CVSS Scores: | CVE | CVSS Vector | Base...

EUVD-2026-53019

A vulnerability was found in UTT HiPER 1250GW up to 3.2.7-210907-180535. Impacted is the function strcpy of the file /goform/APSecurity5g. Performing a manipulation of the argument cipher results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been...

PT-2026-67935

Name of the Vulnerable Software and Affected Versions UTT HiPER 1250GW versions prior to 3.2.7-210907-180535 Description A stack-based buffer overflow occurs in the strcpy function within the /goform/APSecurity 5g file. This issue can be triggered remotely by manipulating the cipher argument. A...

Exploit for Use After Free in Linux Linux_Kernel

CVE-2026-43499-A36 Standalone, device-tested CVE-2026-43499 p...

HPESBNW05077 rev.1 - HPE Networking Private 5G Core, Multiple vulnerabilities

Potential Security Impact: Remote: Authentication Bypass, Denial of Service DoS, Directory Traversal, Unauthorized Read Access to Data, Unauthorized Read Access to Files SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Aruba Networking Private 5G Core version = 1.26.1.0 CVSS...

📄 Phoenix Contact TC Router 5004T-5G EU 1.06.18 Authenticated Command Injection

Proof of concept for an authenticated command injection vulnerability in certain Phoenix Contact TC Routers such as 5004T-5G EU with firmware versions 1.06.18 and below...