Vulnerabilidades em Free5GC
58 resultadosAnálise Vexday
Free5GC apresenta footprint reduzido de vulnerabilidades (4 CVEs totais) sem registros de exploração ativa no campo. Nenhuma vulnerabilidade crítica foi identificada, e o risco não apresenta movimento recente, indicando panorama de segurança estável. A fraqueza dominante catalogada (CWE-404 - Improper Resource Validation) sugere falhas pontuais em validação, porém com baixa urgência operacional no contexto atual.
CVE-2026-55785LOWfree5GC AUSF uses non-constant-time authentication comparisons and logs XRES* in 5G-AKAEPSS 0.4%CVE-2023-4659CRITICALCross-Site Request Forgery in Free5GcEPSS 0.4%CVE-2026-32937HIGHfree5GC CHF has Out-of-Bounds Slice Access that Leads to DoSEPSS 0.4%CVE-2026-40248HIGHfree5gc UDR improper path validation allows unauthenticated creation and modification of Traffic Influence SubscriptionsEPSS 0.4%CVE-2026-44324MEDIUMfree5GC: UDR nudr-dr DELETE amf-subscriptions panics on missing UE state via nil interface type assertion (single authenticated request)EPSS 0.4%CVE-2026-55784HIGHfree5GC AUSF authentication contexts can be overwritten by concurrent requests for the same SUPIEPSS 0.4%CVE-2025-69232LOWfree5GC hasProtocol Compliance Violation in UPF Leading to SMF Service DisruptionEPSS 0.4%CVE-2025-69253MEDIUMfree5GC vulnerable to improper error handling in NEF with information exposureEPSS 0.4%CVE-2026-44319HIGHfree5GC: NEF crashes via logger.Fatal on PFD notification delivery failure (attacker-controlled notifyUri)EPSS 0.4%CVE-2026-44316HIGHfree5GC: PCF npcf-smpolicycontrol POST /sm-policies panics on downstream UDR/OpenAPI 404 via nil pointer dereferenceEPSS 0.4%CVE-2026-44325HIGHfree5GC: NRF POST /oauth2/token structured-form parser type-confusion panic family (Reflect.Set on incompatible types)EPSS 0.4%CVE-2026-44322HIGHfree5GC: NEF 3gpp-pfd-management PATCH applications/{appId} panics on UDR access failure due to nil ProblemDetails dereferenceEPSS 0.4%CVE-2026-40246HIGHfree5gc UDR improper path validation allows unauthenticated deletion of Traffic Influence SubscriptionsEPSS 0.4%CVE-2026-33191HIGHfree5GC UDM vulnerable to null byte injection in URL path parameters causing 500 Internal Server ErrorEPSS 0.4%CVE-2026-44321HIGHfree5GC: SMF UPI POST /upi/v1/upNodesLinks exits the SMF process on overlapping UE pools (unauthenticated, reachable Fatalf)EPSS 0.4%CVE-2026-25501MEDIUMfree5GC SMF crash (nil pointer dereference) on PFCP SessionReportRequest when ReportType.DLDR is set but DownlinkDataReport IE is missingEPSS 0.4%CVE-2026-26025MEDIUMfree5GC SMF crash (nil pointer dereference) on PFCP SessionReportRequest when ReportType.USAR=1 and UsageReport omits mandatory URRID sub-IE EPSS 0.4%CVE-2026-26024MEDIUMfree5GC SMF crash (nil pointer dereference) on PFCP SessionReportRequest when ReportType.USAR=1 and UsageReport omits mandatory URRID sub-IE EPSS 0.4%CVE-2026-44323MEDIUMfree5GC: UDR nudr-dr DELETE amf-subscriptions panics on missing subsId when UE state exists (nil pointer dereference)EPSS 0.4%CVE-2026-44317MEDIUMfree5GC: PCF npcf-policyauthorization POST /app-sessions panics on suppFeat=1 with missing AfRoutReq via nil pointer dereferenceEPSS 0.4%