GHSA-6GXQ-GPR8-XGJP free5GC UDR has improper `ueId` validation in EE subscription handlers that allows arbitrary identifier persistence

Summary The free5GC UDR accepts arbitrary non-3GPP ueId values in the EE subscription creation and query flows because the regular expression used for validation ends with the catch-all alternative |.+. This causes the validation logic to accept any non-empty string rather than restricting input ...

Improper Input Validation

Overview Affected versions of this package are vulnerable to Improper Input Validation in the ueId validation process in EE subscription handlers. An attacker can cause unauthorized data creation and persistent data corruption by submitting arbitrary identifier values that bypass intended format...

CVE-2025-69251

free5gc UDM provides Unified Data Management UDM for free5GC, an open-source project for 5th generation 5G mobile core networks. In versions up to and including 1.4.1, remote attackers can inject control characters e.g., %00 into the ueId parameter, triggering internal URL parsing errors net/url:...

EUVD-2024-21874

Malicious code in bioql PyPI...

CVE-2024-24455

CVE-2024-24455 affects Hewlett Packard Enterprise Athonet vEPC MME (version 11.4.0). The issue is an invalid memory access when handling a UE Context Release message that contains an invalid UE identifier, which can allow an attacker to cause a Denial of Service (DoS) to the cellular network by r...