CVEs we hold for Open5gs
Records whose assigning authority named Open5gs as the affected vendor. Newest identifiers first, capped at 200.
CVE-2026-92417Open5GS PFCP types.c ogs_pfcp_parse_volume_measurement null pointer dereferencen/a Open5GS
CVE-2026-92416Open5GS PFCP Session Report Request n4-handler.c smf_n4_handle_session_report_request assertionn/a Open5GS
CVE-2026-90707Open5GS Old AMF Discovery Fallback nnrf-handler.c amf_nnrf_try_old_amf_discovery_fallback use after freen/a Open5GS
CVE-2026-8743Open5GS AMF/MME context.c ran_ue_find_by_amf_ue_ngap_id improper authorizationn/a Open5GS
CVE-2026-8728Open5GS NRF conv.c ogs_sbi_discovery_option_parse_plmn_list denial of servicen/a Open5GS
CVE-2026-8290Open5GS SMF nsmf-handler.c smf_nsmf_handle_update_data_in_vsmf denial of servicen/a Open5GS
CVE-2026-8289Open5GS SMF nsmf-handler.c smf_nsmf_handle_update_data_in_vsmf denial of servicen/a Open5GS
CVE-2026-8266Open5GS SMF gsm-build.c gsm_build_pdu_session_establishment_accept denial of servicen/a Open5GS
CVE-2026-82589Open5GS N1-N2 Message namf-handler.c amf_namf_comm_handle_n1_n2_message_transfer denial of servicen/a Open5GS
CVE-2026-82587Open5GS AMF namf-handler.c amf_namf_comm_decode_ue_mm_context_list memory corruptionn/a Open5GS
CVE-2026-8251Open5GS SMF npcf-handler.c update_authorized_pcc_rule_and_qos denial of servicen/a Open5GS
CVE-2026-8250Open5GS SMF n4-build.c smf_n4_build_qos_flow_to_modify_list denial of servicen/a Open5GS
CVE-2026-8249Open5GS SMF npcf-handler.c update_authorized_pcc_rule_and_qos denial of servicen/a Open5GS
CVE-2026-8248Open5GS SMF npcf-handler.c update_authorized_pcc_rule_and_qos denial of servicen/a Open5GS
CVE-2026-8225Open5GS delete Endpoint sm-sm.c pcf_npcf_smpolicycontrol_handle_delete denial of servicen/a Open5GS
CVE-2026-8223Open5GS sm-policies Endpoint pcf_sess_sbi_discover_and_send denial of servicen/a Open5GS
CVE-2026-8222Open5GS sm-policies Endpoint nbsf-handler.c pcf_nbsf_management_handle_register denial of servicen/a Open5GS
CVE-2026-8123Open5GS NSSF message.c ogs_sbi_discovery_option_add_snssais denial of servicen/a Open5GS
CVE-2026-8122Open5GS NSSF message.c ogs_sbi_discovery_option_add_service_names denial of servicen/a Open5GS
CVE-2026-78156Open5GS S6a Authentication-Information-Request hss-s6a-path.c hss_ogs_diam_s6a_air_cb heap-based overflown/a Open5GS
CVE-2026-7781Open5GS amf-3gpp-access Endpoint nudm-handler.c udm_nudm_uecm_handle_amf_registration_update denial of servicen/a Open5GS
CVE-2026-7780Open5GS smf-registrations Endpoint udm-sm.c udm_state_operational denial of servicen/a Open5GS
CVE-2026-7779Open5GS authentication-subscription Endpoint nudr-handler.c udm_nudr_dr_handle_subscription_authentication denial of…n/a Open5GS
CVE-2026-7707Open5GS UDR nudr-handler.c udr_nudr_dr_handle_subscription_context denial of servicen/a Open5GS
CVE-2026-7587Open5GS AMF nsmf-handler.c amf_nsmf_pdusession_handle_update_sm_context denial of servicen/a Open5GS
CVE-2026-7585Open5GS AMF nudm-handler.c amf_nudm_sdm_handle_provisioned denial of servicen/a Open5GS
CVE-2026-7518Open5GS AMF SBI Endpoint sdmsubscription-notify amf_namf_callback_handle_sdm_data_change_notify denial of servicen/a Open5GS
CVE-2026-2062Open5GS PGW S5U Address sgwc_sxa_handle_session_modification_response null pointer dereferencen/a Open5GS
CVE-2026-1737Open5GS CreateBearerRequest s5c-handler.c sgwc_s5c_handle_create_bearer_request assertionn/a Open5GS
CVE-2026-1587Open5GS SGWC s11-handler.c sgwc_s11_handle_modify_bearer_request denial of servicen/a Open5GS
CVE-2026-1522Open5GS SGWC s5c-handler.c sgwc_s5c_handle_modify_bearer_response denial of servicen/a Open5GS
CVE-2026-10157Open5GS NGAP PathSwitchRequest Message ngap-handler.c improper authenticationn/a Open5GS
CVE-2026-10156Open5GS nf-instances Endpoint nnrf-handler.c handle_amf_info resource consumptionn/a Open5GS
CVE-2026-10116Open5GS ue-authentications Endpoint ogs-timer.c ogs_sbi_xact_add denial of servicen/a Open5GS
CVE-2026-10114Open5GS Shared NF-profile nnrf-handler.c handle_scp_info out-of-bounds writen/a Open5GS
CVE-2025-8800Open5GS AMF esm-handler.c esm_handle_pdn_connectivity_request denial of servicen/a Open5GS
CVE-2025-8799Open5GS AMF npcf-build.c amf_nsmf_pdusession_build_create_sm_context denial of servicen/a Open5GS
CVE-2025-8698Open5GS AMF Service nsmf-handler.c amf_nsmf_pdusession_handle_release_sm_context assertionn/a Open5GS
CVE-2025-5501Open5GS NGAP PathSwitchRequest Message ngap-handler.c ngap_handle_path_switch_request_transfer assertionn/a Open5GS
CVE-2025-1925Open5GS AMF nsmf-handler.c amf_nsmf_pdusession_handle_update_sm_context denial of servicen/a Open5GS
CVE-2025-15687Open5GS SMF Diameter Gx Credit-Control-Answer smf_gx_cca_cb denial of servicen/a Open5GS
CVE-2025-15555Open5GS VoLTE Cx-Test hss-cx-path.c hss_ogs_diam_cx_mar_cb stack-based overflown/a Open5GS
CVE-2025-15539Open5GS sgwc s11-handler.c sgwc_s11_handle_downlink_data_notification_ack denial of servicen/a Open5GS
CVE-2025-15529Open5GS s5c-handler.c sgwc_s5c_handle_create_session_response denial of servicen/a Open5GS
CVE-2025-15419Open5GS GTPv2-C Flow s5c-handler.c sgwc_s5c_handle_create_session_response denial of servicen/a Open5GS
CVE-2025-15418Open5GS Bearer QoS IE Length types.c ogs_gtp2_parse_bearer_qos denial of servicen/a Open5GS
CVE-2025-15417Open5GS GTPv2-C F-TEID s11-handler.c sgwc_s11_handle_create_session_request denial of servicen/a Open5GS
CVE-2025-15176Open5GS PFCP Session Establishment Request rule-match.c ogs_pfcp_pdr_rule_find_by_packet assertionn/a Open5GS
CVE-2025-14953Open5GS FAR-ID handler.c ogs_pfcp_handle_create_pdr null pointer dereferencen/a Open5GS
CVE-2024-14043Open5GS Diameter S6a mme-fd-path.c mme_s6a_subscription_data_from_avp heap-based overflown/a Open5GS
CVE-2024-14042Open5GS Diameter S6a hss-s6a-path.c hss_ogs_diam_s6a_ulr_cb stack-based overflown/a Open5GS
131 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.
Everything on this page is free. Public data. Withholding it protects nothing.