Free5gc 3.2.1 - Information Disclosure

Free5gc 3.2.1 is susceptible to information disclosure. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized operations. id: CVE-2022-38870 info: name: Free5gc 3.2.1 - Information Disclosure author: For3stCo1d severity: high description: | Free5gc 3.2.1 ...

CVE-2026-53551

The vulnerability CVE-2026-53551 affects free5GC AUSF prior to version 1.4.5, where the supiOrSuci field in UE authentication requests is not validated. Null bytes (\x00) and other control characters pass through JSON parsing and are forwarded to the UDM in an unescaped URL path, causing Go’s net...

CVE-2026-53551 free5GC AUSF: null byte injection in supiOrSuci causes HTTP 500 internal service failure

free5GC is an open-source implementation of the 5G core network. Prior to 1.4.5, the free5GC AUSF Authentication Server Function does not validate the supiOrSuci field in UE authentication requests. Null bytes \x00 and other control characters pass through JSON parsing unchanged and are forwarded...

GO-2026-5570 Free5gc NRF is vulnerable to scope validation bypass via maliciously crafted targetNF value in github.com/free5gc/nrf

Free5gc NRF is vulnerable to scope validation bypass via maliciously crafted targetNF value in github.com/free5gc/nrf...

GO-2026-5767 Free5GC AMF is vulnerable to DoS through its HandleRegistrationComplete function in github.com/free5gc/amf

Free5GC AMF is vulnerable to DoS through its HandleRegistrationComplete function in github.com/free5gc/amf...

GO-2026-5720 free5GC's PCF npcf-smpolicycontrol POST /sm-policies panics on downstream UDR/OpenAPI 404 via nil pointer dereference in github.com/free5gc/pcf

free5GC's PCF npcf-smpolicycontrol POST /sm-policies panics on downstream UDR/OpenAPI 404 via nil pointer dereference in github.com/free5gc/pcf...

GO-2026-5717 free5GC's NEF nnef-callback route group is unauthenticated; forged callback requests are accepted into the processing path in github.com/free5gc/nef

free5GC's NEF nnef-callback route group is unauthenticated; forged callback requests are accepted into the processing path in github.com/free5gc/nef...

GO-2026-5673 Free5GC AMF has Missing Concurrent NAS SMC Validation During NGAP Handover in github.com/free5gc/amf

Free5GC AMF has Missing Concurrent NAS SMC Validation During NGAP Handover in github.com/free5gc/amf...

GO-2026-5731 free5GC's PCF npcf-policyauthorization POST /app-sessions panics on suppFeat=1 with missing AfRoutReq via nil pointer dereference in github.com/free5gc/pcf

free5GC's PCF npcf-policyauthorization POST /app-sessions panics on suppFeat=1 with missing AfRoutReq via nil pointer dereference in github.com/free5gc/pcf...

GO-2026-5647 free5GC's NEF crashes via logger.Fatal on PFD notification delivery failure (attacker-controlled notifyUri) in github.com/free5gc/nef

free5GC's NEF crashes via logger.Fatal on PFD notification delivery failure attacker-controlled notifyUri in github.com/free5gc/nef...

GO-2026-5613 free5GC AMF: Missing default case in Content-Type switch in HTTPUEContextTransfer in github.com/free5gc/amf

free5GC AMF: Missing default case in Content-Type switch in HTTPUEContextTransfer in github.com/free5gc/amf...

GO-2026-5537 free5GC's SMF UPI DELETE /upi/v1/upNodesLinks/{ref} panics on AN-node deletion via nil UPF dereference; unauthenticated, state-mutating in github.com/free5gc/smf

free5GC's SMF UPI DELETE /upi/v1/upNodesLinks/ref panics on AN-node deletion via nil UPF dereference; unauthenticated, state-mutating in github.com/free5gc/smf...

GO-2026-5482 free5GC UDR: Fail-open handling in PolicyDataSubsToNotifyPost allows unintended subscription creation in github.com/free5gc/udr

free5GC UDR: Fail-open handling in PolicyDataSubsToNotifyPost allows unintended subscription creation in github.com/free5gc/udr...

GO-2026-5407 free5gc UDR fail-open request handling in PolicyDataSubsToNotifySubsIdPut may allow unintended subscription updates after input errors in github.com/free5gc/udr

free5gc UDR fail-open request handling in PolicyDataSubsToNotifySubsIdPut may allow unintended subscription updates after input errors in github.com/free5gc/udr...

GO-2026-5447 free5GC's NEF 3gpp-pfd-management PATCH applications/{appId} panics on UDR access failure due to nil ProblemDetails dereference in github.com/free5gc/nef

free5GC's NEF 3gpp-pfd-management PATCH applications/appId panics on UDR access failure due to nil ProblemDetails dereference in github.com/free5gc/nef...

GO-2026-5349 free5GC NRF: type-confusion panic in POST /oauth2/token structured-form parser via Reflect.Set on incompatible types in github.com/free5gc/nrf

free5GC NRF: type-confusion panic in POST /oauth2/token structured-form parser via Reflect.Set on incompatible types in github.com/free5gc/nrf...

GO-2026-5396 free5gc UDR improper path validation allows unauthenticated deletion of Traffic Influence Subscriptions in github.com/free5gc/udr

free5gc UDR improper path validation allows unauthenticated deletion of Traffic Influence Subscriptions in github.com/free5gc/udr...

GO-2026-5326 free5GC's NEF nnef-oam route group is unauthenticated; no-token requests reach the OAM handler in github.com/free5gc/nef

free5GC's NEF nnef-oam route group is unauthenticated; no-token requests reach the OAM handler in github.com/free5gc/nef...

GO-2026-5189 Free5GC PCF: Missing authentication middleware in Npcf_SMPolicyControl allows access to SM policy handlers and disclosure of subscriber SUPI in github.com/free5gc/pcf

Free5GC PCF: Missing authentication middleware in NpcfSMPolicyControl allows access to SM policy handlers and disclosure of subscriber SUPI in github.com/free5gc/pcf...

GO-2026-5209 Free5GC AMF Bypasses UE Security Capabilities on NGAP PathSwitchRequest in github.com/free5gc/amf

Free5GC AMF Bypasses UE Security Capabilities on NGAP PathSwitchRequest in github.com/free5gc/amf...