CVE-2026-15720 | High | 8.6 | 2026-07-14 | In Open5GS through version 2.7.7 a pre-authentication heap out-of-bounds read in the AMF NAS 5GS mobile-identity handler may result in subscriber-wide denial o… |
CVE-2026-8746 | Medium | 4.3 | 2026-05-17 | A security flaw has been discovered in Open5GS up to 2.7.7. Affected by this issue is the function discover_handler in the library /lib/sbi/nghttp2-server.c of… |
CVE-2026-8745 | Medium | 4.3 | 2026-05-17 | A vulnerability was identified in Open5GS up to 2.7.7. Affected by this vulnerability is the function ogs_timer_add in the library /src/ausf/nausf-handler.c of… |
CVE-2026-8744 | Medium | 4.3 | 2026-05-17 | A vulnerability was determined in Open5GS up to 2.7.7. Affected is the function ogs_sbi_subscription_data_add/ogs_sbi_nf_service_add in the library /lib/sbi/co… |
CVE-2026-8743 | Medium | 6.3 | 2026-05-17 | A vulnerability was found in Open5GS up to 2.7.6. This impacts the function ran_ue_find_by_amf_ue_ngap_id of the file src/amf/context.c of the component AMF/MM… |
CVE-2026-8731 | Medium | 4.3 | 2026-05-17 | A vulnerability has been found in Open5GS up to 2.7.7. Affected is the function ogs_sbi_client_add in the library /lib/sbi/client.c of the component NRF. The m… |
CVE-2026-8730 | Medium | 4.3 | 2026-05-17 | A flaw has been found in Open5GS up to 2.7.6. This impacts the function ogs_sbi_nf_instance_set_id in the library /lib/sbi/context.c of the component NRF. Exec… |
CVE-2026-8729 | Medium | 4.3 | 2026-05-17 | A vulnerability was detected in Open5GS up to 2.7.7. This affects an unknown function in the library /lib/sbi/message.c of the component NRF. Performing a mani… |
CVE-2026-8728 | Medium | 4.3 | 2026-05-17 | A security vulnerability has been detected in Open5GS up to 2.7.7. The impacted element is the function ogs_sbi_discovery_option_parse_plmn_list in the library… |
CVE-2026-8292 | Medium | 4.3 | 2026-05-11 | A security vulnerability has been detected in Open5GS up to 2.7.7. The affected element is the function yuarel_parse in the library /lib/sbi/conv.c of the comp… |
CVE-2026-8291 | Medium | 4.3 | 2026-05-11 | A weakness has been identified in Open5GS up to 2.7.7. Impacted is the function ogs_nnrf_nfm_handle_nf_profile of the file lib/sbi/nnrf-handler.c of the compon… |
CVE-2026-8290 | Medium | 4.3 | 2026-05-11 | A security flaw has been discovered in Open5GS up to 2.7.7. This issue affects the function smf_nsmf_handle_update_data_in_vsmf of the file /src/smf/nsmf-handl… |
CVE-2026-8289 | Medium | 4.3 | 2026-05-11 | A vulnerability was identified in Open5GS up to 2.7.7. This vulnerability affects the function smf_nsmf_handle_update_data_in_vsmf of the file /src/smf/nsmf-ha… |
CVE-2026-8288 | Medium | 4.3 | 2026-05-11 | A vulnerability was determined in Open5GS up to 2.7.7. This affects the function gsm_handle_pdu_session_modification_qos_flow_descriptions of the file src/smf/… |
CVE-2026-8270 | Medium | 4.3 | 2026-05-11 | A vulnerability was determined in Open5GS up to 2.7.7. The affected element is the function ogs_nas_parse_qos_rules of the component SMF. Executing a manipulat… |
CVE-2026-8269 | Medium | 4.3 | 2026-05-11 | A vulnerability was found in Open5GS up to 2.7.7. Impacted is the function smf_nsmf_handle_create_sm_context of the component SMF. Performing a manipulation re… |
CVE-2026-8268 | Medium | 4.3 | 2026-05-11 | A vulnerability has been found in Open5GS up to 2.7.7. This issue affects the function OpenAPI_list_create of the component SMF. Such manipulation leads to den… |
CVE-2026-8267 | Medium | 4.3 | 2026-05-11 | A flaw has been found in Open5GS up to 2.7.7. This vulnerability affects the function smf_nsmf_handle_created_data_in_vsmf of the component SMF. This manipulat… |
CVE-2026-8266 | Medium | 4.3 | 2026-05-11 | A vulnerability was detected in Open5GS up to 2.7.7. This affects the function gsm_build_pdu_session_establishment_accept of the file /src/smf/gsm-build.c of t… |
CVE-2026-8252 | Medium | 4.3 | 2026-05-11 | A vulnerability was determined in Open5GS up to 2.7.7. Affected is the function smf_nsmf_handle_create_data_in_hsmf of the component SMF. Executing a manipulat… |
CVE-2026-8251 | Medium | 4.3 | 2026-05-10 | A vulnerability was found in Open5GS up to 2.7.7. This impacts the function update_authorized_pcc_rule_and_qos of the file /src/smf/npcf-handler.c of the compo… |
CVE-2026-8250 | Medium | 4.3 | 2026-05-10 | A vulnerability has been found in Open5GS up to 2.7.7. This affects the function smf_n4_build_qos_flow_to_modify_list of the file /src/smf/n4-build.c of the co… |
CVE-2026-8249 | Medium | 4.3 | 2026-05-10 | A flaw has been found in Open5GS up to 2.7.7. The impacted element is the function update_authorized_pcc_rule_and_qos of the file /src/smf/npcf-handler.c of th… |
CVE-2026-8248 | Medium | 4.3 | 2026-05-10 | A vulnerability was detected in Open5GS up to 2.7.7. The affected element is the function update_authorized_pcc_rule_and_qos of the file /src/smf/npcf-handler… |
CVE-2026-8226 | Medium | 5.3 | 2026-05-10 | A security flaw has been discovered in Open5GS up to 2.7.7. This vulnerability affects the function ogs_pcc_rule_install_flow_from_media in the library /lib/pr… |
CVE-2026-8225 | Medium | 5.3 | 2026-05-10 | A vulnerability was identified in Open5GS up to 2.7.7. This affects the function pcf_npcf_smpolicycontrol_handle_delete of the file src/pcf/sm-sm.c of the comp… |
CVE-2026-8224 | Medium | 5.3 | 2026-05-10 | A vulnerability was determined in Open5GS up to 2.7.7. Affected by this issue is the function pcf_sess_set_ipv6prefix of the file /src/pcf/context.c of the com… |
CVE-2026-8223 | Medium | 5.3 | 2026-05-10 | A vulnerability was found in Open5GS up to 2.7.7. Affected by this vulnerability is the function pcf_sess_sbi_discover_and_send of the component sm-policies En… |
CVE-2026-8222 | Medium | 5.3 | 2026-05-10 | A vulnerability has been found in Open5GS up to 2.7.7. Affected is the function pcf_nbsf_management_handle_register of the file src/pcf/nbsf-handler.c of the c… |
CVE-2026-8186 | Medium | 5.3 | 2026-05-09 | A vulnerability was detected in Open5GS up to 2.7.7. This affects the function ogs_sbi_client_send_via_scp_or_sepp in the library lib/sbi/client.c of the compo… |
CVE-2026-8187 | Medium | 5.3 | 2026-05-09 | A flaw has been found in Open5GS up to 2.7.7. This impacts the function _gtpv1_u_recv_cb of the file src/upf/gtp-path.c of the component UPF. Executing a manip… |
CVE-2026-8123 | Medium | 4.3 | 2026-05-08 | A vulnerability was determined in Open5GS up to 2.7.7. This impacts the function ogs_sbi_discovery_option_add_snssais in the library /lib/sbi/message.c of the… |
CVE-2026-8122 | Medium | 4.3 | 2026-05-08 | A vulnerability was found in Open5GS up to 2.7.7. This affects the function ogs_sbi_discovery_option_add_service_names in the library /lib/sbi/message.c of the… |
CVE-2026-8121 | Medium | 4.3 | 2026-05-08 | A vulnerability has been found in Open5GS up to 2.7.7. The impacted element is the function ogs_sbi_parse_plmn_list in the library /lib/sbi/conv.c of the compo… |
CVE-2026-8120 | Medium | 4.3 | 2026-05-08 | A flaw has been found in Open5GS up to 2.7.7. The affected element is the function nssf_nnrf_nsselection_handle_get_from_amf_or_vnssf of the file /src/nssf/nns… |
CVE-2026-8119 | Low | 3.3 | 2026-05-08 | A vulnerability was detected in Open5GS up to 2.7.7. Impacted is the function ogs_sbi_stream_find_by_id in the library /lib/sbi/nghttp2-server.c of the compone… |
CVE-2026-7587 | Medium | 4.3 | 2026-05-01 | A vulnerability has been found in Open5GS up to 2.7.7. This vulnerability affects the function amf_nsmf_pdusession_handle_update_sm_context of the file /src/am… |
CVE-2026-7586 | Medium | 4.3 | 2026-05-01 | A weakness has been identified in Open5GS up to 2.7.7. Affected is the function ogs_id_get_value of the file /src/amf/nudm-handler.c of the component AMF. This… |
CVE-2026-7585 | Medium | 4.3 | 2026-05-01 | A vulnerability was determined in Open5GS up to 2.7.7. The impacted element is the function amf_nudm_sdm_handle_provisioned of the file /src/amf/nudm-handler.c… |
CVE-2026-4988 | Low | 3.7 | 2026-03-27 | A security flaw has been discovered in Open5GS 2.7.6. This issue affects the function smf_gx_cca_cb/smf_gy_cca_cb/smf_s6b of the component CCA Message Handler… |
CVE-2026-4240 | Medium | 5.3 | 2026-03-16 | A vulnerability was determined in Open5GS up to 2.7.6. The affected element is the function smf_gx_cca_cb/smf_gy_cca_cb/smf_s6b_aaa_cb/smf_s6b_sta_cb of the co… |
CVE-2026-2524 | Medium | 5.3 | 2026-02-16 | A flaw has been found in Open5GS 2.7.6. The impacted element is the function mme_s11_handle_create_session_response of the component MME. This manipulation cau… |
CVE-2026-2523 | Medium | 5.3 | 2026-02-16 | A vulnerability was detected in Open5GS up to 2.7.6. The affected element is the function smf_gn_handle_create_pdp_context_request of the file /src/smf/gn-hand… |
CVE-2026-2522 | Medium | 5.3 | 2026-02-16 | A security vulnerability has been detected in Open5GS up to 2.7.6. Impacted is an unknown function of the file /src/mme/esm-build.c of the component MME. The m… |
CVE-2026-2521 | Medium | 5.3 | 2026-02-15 | A weakness has been identified in Open5GS up to 2.7.6. This issue affects the function sgwc_s5c_handle_create_session_response of the component SGW-C. Executin… |
CVE-2026-2517 | Medium | 5.3 | 2026-02-15 | A security flaw has been discovered in Open5GS up to 2.7.6. This vulnerability affects the function ogs_gtp2_parse_tft in the library lib/gtp/v2/types.c of the… |
CVE-2026-2062 | Medium | 5.3 | 2026-02-06 | A vulnerability was identified in Open5GS up to 2.7.6. This affects the function sgwc_s5c_handle_modify_bearer_response/sgwc_sxa_handle_session_modification_re… |
CVE-2025-15555 | High | 7.3 | 2026-02-04 | A security flaw has been discovered in Open5GS up to 2.7.6. Affected by this vulnerability is the function hss_ogs_diam_cx_mar_cb of the file src/hss/hss-cx-pa… |
CVE-2026-1738 | Medium | 5.3 | 2026-02-02 | A flaw has been found in Open5GS up to 2.7.6. The impacted element is the function sgwc_tunnel_add of the file /src/sgwc/context.c of the component SGWC. Execu… |
CVE-2026-1737 | Medium | 5.3 | 2026-02-02 | A vulnerability was detected in Open5GS up to 2.7.6. The affected element is the function sgwc_s5c_handle_create_bearer_request of the file /src/sgwc/s5c-handl… |
CVE-2026-1736 | Medium | 5.3 | 2026-02-02 | A security vulnerability has been detected in Open5GS up to 2.7.6. Impacted is the function sgwc_s11_handle_create_indirect_data_forwarding_tunnel_request of t… |
CVE-2026-1587 | Medium | 5.3 | 2026-01-29 | A vulnerability has been found in Open5GS up to 2.7.6. The affected element is the function sgwc_s11_handle_modify_bearer_request of the file /sgwc/s11-handler… |
CVE-2026-1586 | Medium | 5.3 | 2026-01-29 | A flaw has been found in Open5GS up to 2.7.5. Impacted is the function ogs_gtp2_f_teid_to_ip of the file /sgwc/s11-handler.c of the component SGWC. Executing a… |
CVE-2026-1522 | Medium | 5.3 | 2026-01-28 | A weakness has been identified in Open5GS up to 2.7.6. This vulnerability affects the function sgwc_s5c_handle_modify_bearer_response of the file src/sgwc/s5c-… |
CVE-2026-1521 | Medium | 5.3 | 2026-01-28 | A security flaw has been discovered in Open5GS up to 2.7.6. This affects the function sgwc_s5c_handle_bearer_resource_failure_indication of the file src/sgwc/s… |
CVE-2026-0622 | Medium | 6.5 | 2026-01-20 | Open 5GS WebUI uses a hard-coded JWT signing key (change-me) whenever the environment variable JWT_SECRET_KEY is unset |
CVE-2025-15539 | Medium | 5.3 | 2026-01-19 | A vulnerability was determined in Open5GS up to 2.7.6. Impacted is the function sgwc_s11_handle_downlink_data_notification_ack of the file src/sgwc/s11-handler… |
CVE-2025-15532 | Medium | 5.3 | 2026-01-17 | A security flaw has been discovered in Open5GS up to 2.7.5. This issue affects some unknown processing of the component Timer Handler. The manipulation results… |
CVE-2025-15531 | Medium | 5.3 | 2026-01-17 | A vulnerability was identified in Open5GS up to 2.7.5. This vulnerability affects the function sgwc_bearer_add of the file src/sgwc/context.c. The manipulation… |
CVE-2025-15530 | Medium | 5.3 | 2026-01-17 | A vulnerability was determined in Open5GS up to 2.7.6. This affects the function sgwc_s11_handle_create_indirect_data_forwarding_tunnel_request of the file /sr… |
CVE-2025-15529 | Medium | 5.3 | 2026-01-16 | A vulnerability was found in Open5GS up to 2.7.6. Affected by this issue is the function sgwc_s5c_handle_create_session_response of the file src/sgwc/s5c-handl… |
CVE-2025-15528 | Medium | 5.3 | 2026-01-16 | A vulnerability has been found in Open5GS up to 2.7.6. Affected by this vulnerability is an unknown functionality of the component GTPv2 Bearer Response Handle… |
CVE-2025-15419 | Low | 3.3 | 2026-01-02 | A weakness has been identified in Open5GS up to 2.7.6. Affected by this issue is the function sgwc_s5c_handle_create_session_response of the file src/sgwc/s5c-… |
CVE-2025-15418 | Low | 3.3 | 2026-01-02 | A security flaw has been discovered in Open5GS up to 2.7.6. Affected by this vulnerability is the function ogs_gtp2_parse_bearer_qos in the library lib/gtp/v2/… |
CVE-2025-15417 | Low | 3.3 | 2026-01-01 | A vulnerability was identified in Open5GS up to 2.7.6. Affected is the function sgwc_s11_handle_create_session_request of the file src/sgwc/s11-handler.c of th… |
CVE-2025-15176 | Medium | 5.3 | 2025-12-29 | A flaw has been found in Open5GS up to 2.7.5. This affects the function decode_ipv6_header/ogs_pfcp_pdr_rule_find_by_packet of the file lib/pfcp/rule-match.c o… |
CVE-2025-14955 | Low | 3.7 | 2025-12-19 | A vulnerability was found in Open5GS up to 2.7.5. Affected by this vulnerability is the function ogs_pfcp_handle_create_pdr in the library lib/pfcp/handler.c o… |
CVE-2025-14954 | Low | 3.7 | 2025-12-19 | A vulnerability has been found in Open5GS up to 2.7.6. Affected is the function ogs_pfcp_pdr_find_or_add/ogs_pfcp_far_find_or_add/ogs_pfcp_urr_find_or_add/ogs_… |
CVE-2025-14953 | Low | 3.1 | 2025-12-19 | A flaw has been found in Open5GS up to 2.7.5. This impacts the function ogs_pfcp_handle_create_pdr in the library lib/pfcp/handler.c of the component FAR-ID Ha… |
CVE-2025-65559 | High | 7.5 | 2025-12-18 | An issue was discovered in Open5GS 2.7.5-49-g465e90f, when processing a PFCP Session Establishment Request (type=50), the UPF crashes with a reachable assertio… |
CVE-2025-63288 | High | 7.5 | 2025-11-10 | In Open5GS 2.7.6, AMF crashes when receiving an abnormal NGSetupRequest message, resulting in denial of service. |
CVE-2025-41068 | High | 7.5 | 2025-10-27 | Reachable Assertion vulnerability in Open5GS up to version 2.7.6 allows attackers with connectivity to the NRF to cause a denial of service. This is achieved b… |
CVE-2025-41067 | High | 7.5 | 2025-10-27 | Reachable Assertion vulnerability in Open5GS up to version 2.7.6 allows attackers with connectivity to the NRF to cause a denial of service. An SBI request tha… |
CVE-2025-55904 | Medium | 4.0 | 2025-09-17 | Open5GS v2.7.5, prior to commit 67ba7f92bbd7a378954895d96d9d7b05d5b64615, is vulnerable to a NULL pointer dereference when a multipart/related HTTP POST reques… |
CVE-2025-52322 | High | 7.5 | 2025-09-09 | An issue in Open5GS v2.7.2 and before allows a remote attacker to cause a denial of service via a crafted Create Session Request message to the SMF (PGW-C), us… |
CVE-2025-52288 | High | 7.5 | 2025-09-08 | Assertion failure in function ngap_build_downlink_nas_transport in file src/amf/ngap-build.c, the Access and Mobility Management Function (AMF) component, in O… |
CVE-2025-9405 | Medium | 5.3 | 2025-08-25 | A security flaw has been discovered in Open5GS up to 2.7.5. The impacted element is the function gmm_state_exception of the file src/amf/gmm-sm.c. The manipula… |
CVE-2025-8805 | Medium | 5.3 | 2025-08-10 | A vulnerability was determined in Open5GS up to 2.7.5. Affected by this issue is the function smf_gsm_state_wait_pfcp_deletion of the file src/smf/gsm-sm.c of… |
CVE-2025-8804 | Medium | 5.3 | 2025-08-10 | A vulnerability was found in Open5GS up to 2.7.5. Affected by this vulnerability is the function ngap_build_downlink_nas_transport of the component AMF. The ma… |
CVE-2025-8803 | Medium | 5.3 | 2025-08-10 | A vulnerability has been found in Open5GS up to 2.7.5. Affected is the function gmm_state_de_registered/gmm_state_exception of the file src/amf/gmm-sm.c of the… |
CVE-2025-8802 | Medium | 5.3 | 2025-08-10 | A vulnerability was determined in Open5GS up to 2.7.5. This vulnerability affects the function smf_state_operational of the file src/smf/smf-sm.c of the compon… |
CVE-2025-8801 | Medium | 5.3 | 2025-08-10 | A vulnerability was found in Open5GS up to 2.7.5. This affects the function gmm_state_exception of the file src/amf/gmm-sm.c of the component AMF. The manipula… |
CVE-2025-8800 | Medium | 5.3 | 2025-08-10 | A vulnerability has been found in Open5GS up to 2.7.5. Affected by this issue is the function esm_handle_pdn_connectivity_request of the file src/mme/esm-handl… |
CVE-2025-8799 | Medium | 5.3 | 2025-08-10 | A vulnerability was identified in Open5GS up to 2.7.5. Affected by this vulnerability is the function amf_npcf_am_policy_control_build_create/amf_nsmf_pdusessi… |
CVE-2025-8698 | Low | 3.3 | 2025-08-07 | A vulnerability was found in Open5GS up to 2.7.5. It has been classified as problematic. Affected is the function amf_nsmf_pdusession_handle_release_sm_context… |
CVE-2025-7485 | Low | 3.3 | 2025-07-12 | A vulnerability classified as problematic was found in Open5GS up to 2.7.3. Affected by this vulnerability is the function ngap_recv_handler/s1ap_recv_handler/… |
CVE-2025-6952 | Low | 3.3 | 2025-07-01 | A vulnerability, which was classified as problematic, has been found in Open5GS up to 2.7.5. This issue affects the function amf_state_operational of the file… |
CVE-2025-29646 | High | 7.1 | 2025-06-18 | An issue in upf in open5gs 2.7.2 and earlier allows a remote attacker to cause a Denial of Service via a crafted PFCP SessionEstablishmentRequest packet with r… |
CVE-2025-44952 | High | 7.8 | 2025-06-18 | A missing length check in `ogs_pfcp_subnet_add` function from PFCP library, used by both smf and upf in open5gs 2.7.2 and earlier, allows a local attacker to c… |
CVE-2025-44951 | High | 7.1 | 2025-06-18 | A missing length check in `ogs_pfcp_dev_add` function from PFCP library, used by both smf and upf in open5gs 2.7.2 and earlier, allows a local attacker to caus… |
CVE-2025-5935 | Medium | 5.3 | 2025-06-10 | A vulnerability was found in Open5GS up to 2.7.3. It has been declared as problematic. Affected by this vulnerability is the function common_register_state of… |
CVE-2025-5520 | Medium | 5.3 | 2025-06-03 | A vulnerability was found in Open5GS up to 2.7.3. It has been classified as problematic. Affected is the function gmm_state_authentication/emm_state_authentica… |
CVE-2025-5501 | Medium | 5.3 | 2025-06-03 | A vulnerability classified as problematic was found in Open5GS up to 2.7.3. Affected by this vulnerability is the function ngap_handle_path_switch_request_tran… |
CVE-2025-29339 | High | 7.5 | 2025-04-22 | An issue in UPF in Open5GS UPF versions up to v2.7.2 results an assertion failure vulnerability in PFCP session parameter validation. When processing a PFCP Se… |
CVE-2025-25774 | Medium | 6.5 | 2025-03-12 | An issue was discovered in Open5GS v2.7.2. When a UE switches between two gNBs and sends a handover request at a specific time, it may cause an exception in th… |
CVE-2025-1925 | Medium | 5.3 | 2025-03-04 | A vulnerability classified as problematic was found in Open5GS up to 2.7.2. Affected by this vulnerability is the function amf_nsmf_pdusession_handle_update_sm… |
CVE-2025-1893 | Medium | 4.3 | 2025-03-04 | A vulnerability was found in Open5GS up to 2.7.2. It has been declared as problematic. Affected by this vulnerability is the function gmm_state_authentication… |
CVE-2024-56921 | High | 7.5 | 2025-02-03 | An issue was discovered in Open5gs v2.7.2. InitialUEMessage, Registration request sent at a specific time can crash AMF due to incorrect error handling of gmm_… |
CVE-2024-57519 | High | 7.5 | 2025-01-28 | An issue in Open5GS v.2.7.2 allows a remote attacker to cause a denial of service via the ogs_dbi_auth_info function in lib/dbi/subscription.c file. |
CVE-2024-24429 | High | 8.6 | 2025-01-22 | A reachable assertion in the nas_eps_send_emm_to_esm function of Open5GS <= 2.6.4 allows attackers to cause a Denial of Service (DoS) via a crafted NGAP packet. |