Vulnerabilidades em free5gc
58 resultadosAnálise Vexday
Free5gc apresenta 48 vulnerabilidades catalogadas, com 20 divulgadas nos últimos 90 dias, indicando ritmo significativo de descobertas. Embora nenhuma esteja sob exploração ativa conhecida (KEV), 5 são críticas, sendo CWE-476 (null pointer dereference) o padrão predominante, sugerindo falhas sistemáticas em validação de entrada que demandam atenção imediata para implementações em produção.
CVE-2026-55785LOWfree5GC AUSF uses non-constant-time authentication comparisons and logs XRES* in 5G-AKAEPSS 0.4%CVE-2023-4659CRITICALCross-Site Request Forgery in Free5GcEPSS 0.4%CVE-2026-32937HIGHfree5GC CHF has Out-of-Bounds Slice Access that Leads to DoSEPSS 0.4%CVE-2026-40248HIGHfree5gc UDR improper path validation allows unauthenticated creation and modification of Traffic Influence SubscriptionsEPSS 0.4%CVE-2026-44324MEDIUMfree5GC: UDR nudr-dr DELETE amf-subscriptions panics on missing UE state via nil interface type assertion (single authenticated request)EPSS 0.4%CVE-2026-55784HIGHfree5GC AUSF authentication contexts can be overwritten by concurrent requests for the same SUPIEPSS 0.4%CVE-2025-69232LOWfree5GC hasProtocol Compliance Violation in UPF Leading to SMF Service DisruptionEPSS 0.4%CVE-2025-69253MEDIUMfree5GC vulnerable to improper error handling in NEF with information exposureEPSS 0.4%CVE-2026-44319HIGHfree5GC: NEF crashes via logger.Fatal on PFD notification delivery failure (attacker-controlled notifyUri)EPSS 0.4%CVE-2026-44316HIGHfree5GC: PCF npcf-smpolicycontrol POST /sm-policies panics on downstream UDR/OpenAPI 404 via nil pointer dereferenceEPSS 0.4%CVE-2026-44325HIGHfree5GC: NRF POST /oauth2/token structured-form parser type-confusion panic family (Reflect.Set on incompatible types)EPSS 0.4%CVE-2026-44322HIGHfree5GC: NEF 3gpp-pfd-management PATCH applications/{appId} panics on UDR access failure due to nil ProblemDetails dereferenceEPSS 0.4%CVE-2026-40246HIGHfree5gc UDR improper path validation allows unauthenticated deletion of Traffic Influence SubscriptionsEPSS 0.4%CVE-2026-33191HIGHfree5GC UDM vulnerable to null byte injection in URL path parameters causing 500 Internal Server ErrorEPSS 0.4%CVE-2026-44321HIGHfree5GC: SMF UPI POST /upi/v1/upNodesLinks exits the SMF process on overlapping UE pools (unauthenticated, reachable Fatalf)EPSS 0.4%CVE-2026-25501MEDIUMfree5GC SMF crash (nil pointer dereference) on PFCP SessionReportRequest when ReportType.DLDR is set but DownlinkDataReport IE is missingEPSS 0.4%CVE-2026-26025MEDIUMfree5GC SMF crash (nil pointer dereference) on PFCP SessionReportRequest when ReportType.USAR=1 and UsageReport omits mandatory URRID sub-IE EPSS 0.4%CVE-2026-26024MEDIUMfree5GC SMF crash (nil pointer dereference) on PFCP SessionReportRequest when ReportType.USAR=1 and UsageReport omits mandatory URRID sub-IE EPSS 0.4%CVE-2026-44323MEDIUMfree5GC: UDR nudr-dr DELETE amf-subscriptions panics on missing subsId when UE state exists (nil pointer dereference)EPSS 0.4%CVE-2026-44317MEDIUMfree5GC: PCF npcf-policyauthorization POST /app-sessions panics on suppFeat=1 with missing AfRoutReq via nil pointer dereferenceEPSS 0.4%