| CVE-2026-1684 | ALTO7.5 | A vulnerability was found in Free5GC SMF up to 4.1.0. Affected by this issue is the function HandleReports of the file /internal/context/pfcp_reports.go of the component PFCP UDP Endpoint. The manipulation results in denial of service. The attack can be executed remotely. It is advisable to implement a patch to correct | 30/01/2026 |
| CVE-2026-1683 | ALTO7.5 | A vulnerability has been found in Free5GC SMF up to 4.1.0. Affected by this vulnerability is the function HandlePfcpSessionReportRequest of the file internal/pfcp/handler/handler.go of the component PFCP. The manipulation leads to denial of service. Remote exploitation of the attack is possible. The exploit has been di | 30/01/2026 |
| CVE-2026-1682 | ALTO7.5 | A flaw has been found in Free5GC SMF up to 4.1.0. Affected is the function HandlePfcpAssociationReleaseRequest of the file internal/pfcp/handler/handler.go of the component PFCP UDP Endpoint. Executing a manipulation can lead to null pointer dereference. The attack may be launched remotely. The exploit has been publish | 30/01/2026 |
| CVE-2025-65562 | ALTO7.5 | The free5GC UPF suffers from a lack of bounds checking on the SEID when processing PFCP Session Deletion Requests. An unauthenticated remote attacker can send a request with a very large SEID (e.g., 0xFFFFFFFFFFFFFFFF) that causes an integer conversion/underflow in LocalNode.DeleteSess() / LocalNode.Sess() when a uint6 | 18/12/2025 |
| CVE-2025-65561 | ALTO7.5 | An issue was discovered in function LocalNode.Sess in free5GC 4.1.0 allowing attackers to cause a denial of service or other unspecified impacts via crafted header Local SEID to the PFCP Session Modification Request. | 18/12/2025 |
| CVE-2025-60638 | ALTO7.5 | An issue was discovered in Free5GC v4.0.0 and v4.0.1 allowing an attacker to cause a denial of service via crafted POST request to the Nnssf_NSSAIAvailability API. | 24/11/2025 |
| CVE-2025-60633 | MEDIO6.5 | An issue was discovered in Free5GC v4.0.0 and v4.0.1 allowing an attacker to cause a denial of service via the Nudm_SubscriberDataManagement API. | 24/11/2025 |
| CVE-2025-60632 | MEDIO6.5 | An issue was discovered in Free5GC v4.0.0 and v4.0.1 allowing an attacker to cause a denial of service via crafted POST request to the Npcf_BDTPolicyControl API. | 24/11/2025 |
| CVE-2025-63679 | ALTO7.5 | free5gc v4.1.0 and before is vulnerable to Buffer Overflow. When AMF receives an UplinkRANConfigurationTransfer NGAP message from a gNB, the AMF process crashes. | 12/11/2025 |
| CVE-2025-56394 | ALTO7.5 | Free5gc 4.0.1 is vulnerable to Buffer Overflow. The AMF incorrectly validates the 5GS mobile identity, resulting in slice reference overflow. | 23/09/2025 |
| CVE-2025-29632 | MEDIO5.4 | Buffer Overflow vulnerability in Free5gc v.4.0.0 allows a remote attacker to cause a denial of service via the AMF, NGAP, security.go, handler_generated.go, handleInitialUEMessageMain, DecodePlainNasNoIntegrityCheck, GetSecurityHeaderType components | 29/05/2025 |
| CVE-2023-49391 | ALTO7.5 | An issue was discovered in free5GC version 3.3.0, allows remote attackers to execute arbitrary code and cause a denial of service (DoS) on AMF component via crafted NGAP message. | 22/12/2023 |
| CVE-2023-47025 | MEDIO5.5 | An issue in Free5gc v.3.3.0 allows a local attacker to cause a denial of service via the free5gc-compose component. | 16/11/2023 |
| CVE-2023-47347 | ALTO7.5 | Buffer Overflow vulnerability in free5gc 3.3.0 allows attackers to cause a denial of service via crafted PFCP messages whose Sequence Number is mutated to overflow bytes. | 15/11/2023 |
| CVE-2023-47345 | ALTO7.5 | Buffer Overflow vulnerability in free5gc 3.3.0 allows attackers to cause a denial of service via crafted PFCP message with malformed PFCP Heartbeat message whose Recovery Time Stamp IE length is mutated to zero. | 15/11/2023 |
| CVE-2023-47346 | ALTO7.5 | Buffer Overflow vulnerability in free5gc 3.3.0, UPF 1.2.0, and SMF 1.2.0 allows attackers to cause a denial of service via crafted PFCP messages. | 13/11/2023 |
| CVE-2022-38871 | ALTO7.5 | In Free5gc v3.0.5, the AMF breaks due to malformed NAS messages. | 18/11/2022 |
| CVE-2022-38870 | ALTO7.5 | Free5gc v3.2.1 is vulnerable to Information disclosure. | 25/10/2022 |
| CVE-2022-43677 | MEDIO5.5 | In free5GC 3.2.1, a malformed NGAP message can crash the AMF and NGAP decoders via an index-out-of-range panic in aper.GetBitString. | 24/10/2022 |