EUVD-2026-109913

Open5GS 1.3.0 through 2.8.0 contains a heap out-of-bounds write vulnerability in parsemultipart that allows unauthenticated attackers to corrupt memory by supplying an empty multipart boundary. Attackers can send a single crafted multipart/related request to the SBI interface of any network...

CVE-2026-116543 Open5GS 1.3.0 through 2.8.0 Heap Out-of-Bounds Write via SBI Multipart Parser

Open5GS 1.3.0 through 2.8.0 contains a heap out-of-bounds write vulnerability in parsemultipart that allows unauthenticated attackers to corrupt memory by supplying an empty multipart boundary. Attackers can send a single crafted multipart/related request to the SBI interface of any network...

CVE-2026-116543

The Open5GS software (versions 1.3.0 through 2.8.0 ) is vulnerable to a heap out-of-bounds write in the parse_multipart() function. An unauthenticated attacker can cause memory corruption or a crash by sending a single crafted multipart/related request to the SBI interface of any network function...

GHSA-98CP-84M9-Q3QP free5GC PCF: Memory Leak via CORS Middleware Registration in HTTP Handler Leads to Denial of Service

Summary A memory leak vulnerability in the free5GC PCF Policy Control Function allows any unauthenticated attacker with network access to the PCF SBI interface to cause uncontrolled memory growth by sending repeated HTTP requests to the OAM endpoint. The root cause is a router.Use call inside an...

CVE-2025-66786

OpenAirInterface CN5G AMF=v2.0.1 There is a logical error when processing JSON format requests. Unauthorized remote attackers can send malicious JSON data to AMF's SBI interface to launch a denial-of-service attack...

CVE-2025-66786

OpenAirInterface CN5G AMF=v2.0.1 There is a logical error when processing JSON format requests. Unauthorized remote attackers can send malicious JSON data to AMF's SBI interface to launch a denial-of-service attack...

CVE-2025-66786

OpenAirInterface CN5G AMF=v2.0.1 There is a logical error when processing JSON format requests. Unauthorized remote attackers can send malicious JSON data to AMF's SBI interface to launch a denial-of-service attack...

CVE-2025-66786: Improper Input Validation

OpenAirInterface CN5G AMF=v2.0.1 There is a logical error when processing JSON format requests. Unauthorized remote attackers can send malicious JSON data to AMF's SBI interface to launch a denial-of-service attack...

CVE-2025-41068

CVE-2025-41068 : Reachable Assertion in Open5GS NRF. Affected: Open5GS up to version 2.7.6 (and variants cited as up to 2.7.5 in some sources). Condition: attacker with network access to the NRF can trigger by sending an NF creation request with an invalid type via the SBI, then request its data....

PT-2025-38150

Name of the Vulnerable Software and Affected Versions: Open5GS versions prior to commit 67ba7f92bbd7a378954895d96d9d7b05d5b64615 Description: Open5GS is susceptible to a NULL pointer dereference when processing a multipart/related HTTP POST request with an empty HTTP body sent to the SBI of AMF,...