Free5gc 3.2.1 - Information Disclosure

Free5gc 3.2.1 is susceptible to information disclosure. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized operations. id: CVE-2022-38870 info: name: Free5gc 3.2.1 - Information Disclosure author: For3stCo1d severity: high description: | Free5gc 3.2.1 ...

CVE-2026-106805

A resource exhaustion issue exists in Free5GC v4.2.3 during PFCP Session Establishment failure handling. When the SMF does not receive a PFCP Session Establishment Response from the UPF, allocated UE IP address resources are not properly released. Repeated failed session establishment attempts ca...

CVE-2026-106805

A resource exhaustion vulnerability exists in Free5GC v4.2.3 during PFCP Session Establishment failure handling. The root cause is that the SMF fails to properly release allocated UE IP address resources when a PFCP Session Establishment Response is not received from the UPF . This allows an atta...

CVE-2026-106805: n/a: A resource exhaustion issue exists in Free5GC v4.2.3 during PFCP Session Establishment failure handling

A resource exhaustion issue exists in Free5GC v4.2.3 during PFCP Session Establishment failure handling. When the SMF does not receive a PFCP Session Establishment Response from the UPF, allocated UE IP address resources are not properly released. Repeated failed session establishment attempts ca...

PT-2026-135533

A resource exhaustion issue exists in Free5GC v4.2.3 during PFCP Session Establishment failure handling. When the SMF does not receive a PFCP Session Establishment Response from the UPF, allocated UE IP address resources are not properly released. Repeated failed session establishment attempts ca...

CVE-2026-106805

A resource exhaustion issue exists in Free5GC v4.2.3 during PFCP Session Establishment failure handling. When the SMF does not receive a PFCP Session Establishment Response from the UPF, allocated UE IP address resources are not properly released. Repeated failed session establishment attempts ca...

CVE-2026-106805

A resource exhaustion issue exists in Free5GC v4.2.3 during PFCP Session Establishment failure handling. When the SMF does not receive a PFCP Session Establishment Response from the UPF, allocated UE IP address resources are not properly released. Repeated failed session establishment attempts ca...

EUVD-2026-115346

A resource exhaustion issue exists in Free5GC v4.2.3 during PFCP Session Establishment failure handling. When the SMF does not receive a PFCP Session Establishment Response from the UPF, allocated UE IP address resources are not properly released. Repeated failed session establishment attempts ca...

CVE-2025-29632

Author: HanyiLuo, Yuqi Huo CVE-2025-29632 the information for the vulnerability covered by CVE-2025-29632 Affected versions: 4.0.0 and previous versions When free5gc processes the InitialUEMessage, it only checks whether the nASPDU reference is nil i.e., whether it is a null pointer, but does not...

free5gc v4.2.3+ Root CA Private Key Exposure

free5gc versions v1.0.0 through v4.2.3+ contain a publicly committed Root CA private key that can be used to forge trusted network function certificates in deployments using its shipped TLS trust anchor. A proof of concept is provided. https://packetstorm.news/download/238561...

free5GC BSF 1754bde Missing Authentication

free5GC BSF version 1754bde and earlier exposes its SBI management endpoints without authentication. The proof of concept demonstrates unauthenticated creation, retrieval, modification, and deletion of PCF bindings. https://packetstorm.news/download/238558...

Exploit for CVE-2026-115926

CVE-2026-115926 — BSF Complete Absence of Authentication...

Exploit for CVE-2026-115925

CVE-2026-115925 — Root CA Private Key Exposure 📢 Publishe...

PT-2026-132062

Details and PoC are public for two unpatched free5GC vulnerabilities in the 5G core: BSF auth bypass CVE-2026-115926 and an exposed root CA key. free5GC 5G 5GCore Telecom CVE2026115926 CVE2026115925 PoC OpenSource https://t.co/LuMpsOvtsZ...

CVE-2026-115926

Summary free5GC's Binding Support Function BSF exposes all 13 SBI management endpoints at "/nbsf-management/v1" with zero authentication middleware. Unlike every other free5GC Network Function which uses "RouterAuthorizationCheck" middleware to validate OAuth2 Bearer tokens, the BSF's "AddService...

CVE-2026-115925

Executive Summary This audit identifies a critical security vulnerability where the free5gc project includes an unencrypted Root Certificate Authority CA private key committed directly to the source code repository. This exposes the entire PKI infrastructure and enables complete compromise of...

SUSE CVE-2026-42081

free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, the AMF in Free5GC does not verify the UE Security Capabilities received in NGAP PathSwitchRequest messages against its locally stored values, as mandated by 3GPP TS 33.501 6.7.3.1. A malicious gNB can overwrite the...

SUSE CVE-2026-42082

free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, the AMF in Free5GC does not enforce the concurrent security procedure rules defined in 3GPP TS 33.501 6.9.5.1. The AMF does not check for ongoing N2 handover procedures before initiating a NAS Security Mode Command,...

CVE-2026-94043

A vulnerability was determined in Free5GC up to 4.2.3. This vulnerability affects unknown code of the file /corefuzzerdeps/free5gc/NFs/amf/internal/gmm/handler.go of the component Gmm Handler. This manipulation causes race condition. The attack can be initiated remotely. Patch name:...

CVE-2026-94043

Free5GC (up to 4.2.3 ) contains a race condition in the Gmm Handler component, specifically in the file NFs/amf/internal/gmm/handler.go. The vulnerability is exploitable remotely with no authentication or user interaction required. CVSS 3.1 scoring places the base score at 5.3 (MEDIUM) , with imp...