CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 30/01/2026 |
| CVE-2025-65562 | HOCH7.5 | The free5GC UPF suffers from a lack of bounds checking on the SEID when processing PFCP Session Deletion Requests. An unauthenticated remote attacker can send a request with a very large SEID (e.g., 0xFFFFFFFFFFFFFFFF) that causes an integer conversion/underflow in LocalNode.DeleteSess() / LocalNode.Sess() when a uint6 | 18/12/2025 |
| CVE-2025-65561 | HOCH7.5 | An issue was discovered in function LocalNode.Sess in free5GC 4.1.0 allowing attackers to cause a denial of service or other unspecified impacts via crafted header Local SEID to the PFCP Session Modification Request. | 18/12/2025 |
| CVE-2025-60638 | HOCH7.5 | An issue was discovered in Free5GC v4.0.0 and v4.0.1 allowing an attacker to cause a denial of service via crafted POST request to the Nnssf_NSSAIAvailability API. | 24/11/2025 |
| CVE-2025-60633 | MITTEL6.5 | An issue was discovered in Free5GC v4.0.0 and v4.0.1 allowing an attacker to cause a denial of service via the Nudm_SubscriberDataManagement API. | 24/11/2025 |
| CVE-2025-60632 | MITTEL6.5 | An issue was discovered in Free5GC v4.0.0 and v4.0.1 allowing an attacker to cause a denial of service via crafted POST request to the Npcf_BDTPolicyControl API. | 24/11/2025 |
| CVE-2025-63679 | HOCH7.5 | free5gc v4.1.0 and before is vulnerable to Buffer Overflow. When AMF receives an UplinkRANConfigurationTransfer NGAP message from a gNB, the AMF process crashes. | 12/11/2025 |
| CVE-2025-56394 | HOCH7.5 | Free5gc 4.0.1 is vulnerable to Buffer Overflow. The AMF incorrectly validates the 5GS mobile identity, resulting in slice reference overflow. | 23/09/2025 |
| CVE-2025-29632 | MITTEL5.4 | Buffer Overflow vulnerability in Free5gc v.4.0.0 allows a remote attacker to cause a denial of service via the AMF, NGAP, security.go, handler_generated.go, handleInitialUEMessageMain, DecodePlainNasNoIntegrityCheck, GetSecurityHeaderType components | 29/05/2025 |
| CVE-2023-49391 | HOCH7.5 | An issue was discovered in free5GC version 3.3.0, allows remote attackers to execute arbitrary code and cause a denial of service (DoS) on AMF component via crafted NGAP message. | 22/12/2023 |
| CVE-2023-47025 | MITTEL5.5 | An issue in Free5gc v.3.3.0 allows a local attacker to cause a denial of service via the free5gc-compose component. | 16/11/2023 |
| CVE-2023-47347 | HOCH7.5 | Buffer Overflow vulnerability in free5gc 3.3.0 allows attackers to cause a denial of service via crafted PFCP messages whose Sequence Number is mutated to overflow bytes. | 15/11/2023 |
| CVE-2023-47345 | HOCH7.5 | Buffer Overflow vulnerability in free5gc 3.3.0 allows attackers to cause a denial of service via crafted PFCP message with malformed PFCP Heartbeat message whose Recovery Time Stamp IE length is mutated to zero. | 15/11/2023 |
| CVE-2023-47346 | HOCH7.5 | Buffer Overflow vulnerability in free5gc 3.3.0, UPF 1.2.0, and SMF 1.2.0 allows attackers to cause a denial of service via crafted PFCP messages. | 13/11/2023 |
| CVE-2022-38871 | HOCH7.5 | In Free5gc v3.0.5, the AMF breaks due to malformed NAS messages. | 18/11/2022 |
| CVE-2022-38870 | HOCH7.5 | Free5gc v3.2.1 is vulnerable to Information disclosure. | 25/10/2022 |
| CVE-2022-43677 | MITTEL5.5 | In free5GC 3.2.1, a malformed NGAP message can crash the AMF and NGAP decoders via an index-out-of-range panic in aper.GetBitString. | 24/10/2022 |