839 matches found
CVE-2026-1682
CVE-2026-1682 affects Free5GC SMF up to version 4.1.0, specifically the PFCP UDP Endpoint’s HandlePfcpAssociationReleaseRequest in internal/pfcp/handler/handler.go. The vulnerability allows remote manipulation that can cause a null pointer dereference. An exploit has been published and may be use...
PT-2026-5399
Name of the Vulnerable Software and Affected Versions Free5GC SMF versions prior to 4.1.1 Description A flaw exists in Free5GC SMF, specifically within the PFCP UDP Endpoint component. The issue resides in the HandlePfcpAssociationReleaseRequest function located in the file...
PT-2026-5400
Name of the Vulnerable Software and Affected Versions Free5GC SMF versions through 4.1.0 Description A flaw exists in Free5GC SMF that can lead to a denial of service. The issue is related to the HandlePfcpSessionReportRequest function within the PFCP component, specifically in the file...
free5GC security vulnerabilities
Free5GC is an open-source project for the 5th generation 5G mobile core network. Versions of Free5GC 4.1.0 and earlier contain security vulnerabilities. These vulnerabilities stem from improper handling in the HandleReports function within the PFCP UDP Endpoint component, located in the...
Free5GC code-related vulnerabilities
Free5GC is an open-source project for the 5th generation 5G mobile core network. Versions of Free5GC 4.1.0 and earlier contain code vulnerabilities. These vulnerabilities stem from a null pointer dereferencing in the HandlePfcpAssociationReleaseRequest function within the PFCP UDP Endpoint...
PT-2026-5403
Name of the Vulnerable Software and Affected Versions Free5GC SMF versions prior to 4.1.0 Description A flaw exists within the PFCP UDP Endpoint component of Free5GC SMF. Specifically, the HandleReports function within the /internal/context/pfcp reports.go file is susceptible to manipulation,...
free5GC security vulnerabilities
Free5GC is an open-source project for the 5th generation 5G mobile core network. Versions of Free5GC 4.1.0 and earlier contain security vulnerabilities. These vulnerabilities stem from improper handling in the HandlePfcpSessionReportRequest function in the internal/pfcp/handler/handler.go file...
CVE-2025-66719
An issue was discovered in Free5gc NRF 1.4.0. In the access-token generation logic of free5GC, the AccessTokenScopeCheck function in file internal/sbi/processor/accesstoken.go bypasses all scope validation when the attacker uses a crafted targetNF value. This allows attackers to obtain an access...
CVE-2025-66720
Null pointer dereference in free5gc pcf 1.4.0 in file internal/sbi/processor/ampolicy.go in function HandleDeletePoliciesPolAssoId...
GHSA-Q7C8-GFJH-8V4P Free5gc NRF is vulnerable to scope validation bypass via maliciously crafted targetNF value
An issue was discovered in Free5gc NRF 1.4.0. In the access-token generation logic of free5GC, the AccessTokenScopeCheck function in file internal/sbi/processor/accesstoken.go bypasses all scope validation when the attacker uses a crafted targetNF value. This allows attackers to obtain an access...
Free5gc NRF is vulnerable to scope validation bypass via maliciously crafted targetNF value
An issue was discovered in Free5gc NRF 1.4.0. In the access-token generation logic of free5GC, the AccessTokenScopeCheck function in file internal/sbi/processor/accesstoken.go bypasses all scope validation when the attacker uses a crafted targetNF value. This allows attackers to obtain an access...
CVE-2025-66719
An issue was discovered in Free5gc NRF 1.4.0. In the access-token generation logic of free5GC, the AccessTokenScopeCheck function in file internal/sbi/processor/accesstoken.go bypasses all scope validation when the attacker uses a crafted targetNF value. This allows attackers to obtain an access...
CVE-2025-66719
An issue was discovered in Free5gc NRF 1.4.0. In the access-token generation logic of free5GC, the AccessTokenScopeCheck function in file internal/sbi/processor/accesstoken.go bypasses all scope validation when the attacker uses a crafted targetNF value. This allows attackers to obtain an access...
CVE-2025-66720
Null pointer dereference in free5gc pcf 1.4.0 in file internal/sbi/processor/ampolicy.go in function HandleDeletePoliciesPolAssoId...
PT-2026-4469
Name of the Vulnerable Software and Affected Versions Free5gc NRF version 1.4.0 Description An issue exists in the access-token generation logic of Free5gc. The AccessTokenScopeCheck function within the file internal/sbi/processor/access token.go bypasses scope validation when a crafted targetNF...
CVE-2025-66719
An issue was discovered in Free5gc NRF 1.4.0. In the access-token generation logic of free5GC, the AccessTokenScopeCheck function in file internal/sbi/processor/accesstoken.go bypasses all scope validation when the attacker uses a crafted targetNF value. This allows attackers to obtain an access...
CVE-2025-66719
An issue was discovered in Free5gc NRF 1.4.0. In the access-token generation logic of free5GC, the AccessTokenScopeCheck function in file internal/sbi/processor/accesstoken.go bypasses all scope validation when the attacker uses a crafted targetNF value. This allows attackers to obtain an access...
CVE-2025-66720
CVE-2025-66720 describes a null pointer dereference in free5gc pcf 1.4.0, in file internal/sbi/processor/ampolicy.go function HandleDeletePoliciesPolAssoId. Multiple sources (NVD, Red Hat, CIRCL, Snyk, CVE lists) corroborate the issue and its presence in free5gc/pcf 1.4.0. The advisory notes a cr...
CVE-2025-66719
Summary: CVE-2025-66719 affects Free5GC NRF 1.4.0. The vulnerability lies in the AccessTokenScopeCheck() in internal/sbi/processor/access_token.go, where scope validation is bypassed when a crafted targetNF value is supplied, enabling an attacker to obtain an access token with arbitrary scopes. I...