Open5gs vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-116543 Open5GS 1.3.0 through 2.8.0 contains a heap out-of-bounds write vulnerability in parse_multipart() that allows unauthenticated attackers to corrupt memory by suHigh 8.7 · Oct 26, 2026
• CVE-2026-108105 Open5GS through 2.8.0 contains a reachable assertion vulnerability in mme_gn_handle_sgsn_context_request() that allows remote unauthenticated attackers to crashHigh 8.2 · Oct 9, 2026
• CVE-2026-15720 In Open5GS through version 2.7.7 a pre-authentication heap out-of-bounds read in the AMF NAS 5GS mobile-identity handler may result in subscriber-wide denial ofHigh 8.6 · Jul 14, 2026
• CVE-2025-65559 An issue was discovered in Open5GS 2.7.5-49-g465e90f, when processing a PFCP Session Establishment Request (type=50), the UPF crashes with a reachable assertionHigh 7.5 · Dec 18, 2025
• CVE-2025-63288 In Open5GS 2.7.6, AMF crashes when receiving an abnormal NGSetupRequest message, resulting in denial of service.High 7.5 · Nov 10, 2025
• CVE-2025-52322 An issue in Open5GS v2.7.2 and before allows a remote attacker to cause a denial of service via a crafted Create Session Request message to the SMF (PGW-C), usiHigh 7.5 · Sep 9, 2025
• CVE-2025-52288 Assertion failure in function ngap_build_downlink_nas_transport in file src/amf/ngap-build.c, the Access and Mobility Management Function (AMF) component, in OpHigh 7.5 · Sep 8, 2025
• CVE-2025-29646 An issue in upf in open5gs 2.7.2 and earlier allows a remote attacker to cause a Denial of Service via a crafted PFCP SessionEstablishmentRequest packet with reHigh 7.1 · Jun 18, 2025
• CVE-2025-44952 A missing length check in `ogs_pfcp_subnet_add` function from PFCP library, used by both smf and upf in open5gs 2.7.2 and earlier, allows a local attacker to caHigh 7.8 · Jun 18, 2025
• CVE-2025-44951 A missing length check in `ogs_pfcp_dev_add` function from PFCP library, used by both smf and upf in open5gs 2.7.2 and earlier, allows a local attacker to causeHigh 7.1 · Jun 18, 2025
• CVE-2025-29339 An issue in UPF in Open5GS UPF versions up to v2.7.2 results an assertion failure vulnerability in PFCP session parameter validation.High 7.5 · Apr 22, 2025
• CVE-2024-56921 An issue was discovered in Open5gs v2.7.2.High 7.5 · Feb 3, 2025
• CVE-2024-57519 An issue in Open5GS v.2.7.2 allows a remote attacker to cause a denial of service via the ogs_dbi_auth_info function in lib/dbi/subscription.c file.High 7.5 · Jan 28, 2025
• CVE-2024-24429 A reachable assertion in the nas_eps_send_emm_to_esm function of Open5GS <= 2.6.4 allows attackers to cause a Denial of Service (DoS) via a crafted NGAP packet.High 8.6 · Jan 22, 2025
• CVE-2024-34235 Open5GS MME versions <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface.High 8.6 · Jan 22, 2025
• CVE-2024-24430 A reachable assertion in the mme_ue_find_by_imsi function of Open5GS <= 2.6.4 allows attackers to cause a Denial of Service (DoS) via a crafted NAS packet.High 7.5 · Jan 22, 2025
• CVE-2023-37023 Open5GS MME versions <= 2.6.4 contain a reachable assertion in the `Uplink NAS Transport` packet handler.High 8.6 · Jan 22, 2025
• CVE-2023-37022 Open5GS MME versions <= 2.6.4 contain a reachable assertion in the `UE Context Release Request` packet handler.High 7.5 · Jan 22, 2025
• CVE-2023-37021 Open5GS MME version <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface.High 8.6 · Jan 22, 2025
• CVE-2023-37020 Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface.High 8.6 · Jan 22, 2025
• CVE-2023-37019 Open5GS MME versions <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface.High 8.6 · Jan 22, 2025
• CVE-2023-37018 Open5GS MME versions <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface.High 8.6 · Jan 22, 2025
• CVE-2023-37017 Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface.High 8.6 · Jan 22, 2025
• CVE-2023-37016 Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface.High 8.6 · Jan 22, 2025
• CVE-2023-37015 Open5GS MME versions <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface.High 8.6 · Jan 22, 2025