Advisories · Technology
open5gs.
Every CVE that names open5gs among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 6.3 Medium
Open5GS 2.6.1 through 2.8.0 Out-of-Bounds Read via parse_scheme_output
- open5gs
- Memory corruption
- CVSS 8.7 High
Open5GS 1.3.0 through 2.8.0 Heap Out-of-Bounds Write via SBI Multipart Parser
- open5gs
- Memory corruption
- CVSS 8.2 High
Open5GS through 2.8.0 MME Reachable Assertion via GTPv1 SGSN Context Request
- open5gs
- Denial of service
- CVSS 6.9 Medium
Open5GS through 2.8.0 Heap Out-of-Bounds Read via PFCP Dropped DL Traffic Threshold IE
- open5gs
- Memory corruption
- CVSS 6.9 Medium
Open5GS through 2.8.0 Heap Out-of-Bounds Read via PFCP Volume Measurement IE
- open5gs
- Memory corruption
- CVSS 6.9 Medium
Open5GS GTP-U Receive Path gtp-path.c ogs_pfcp_xact_local_create allocation of resources
- Open5GS
- Denial of service
- CVSS 7.1 High
Open5GS PFCP types.c ogs_pfcp_parse_volume_measurement null pointer dereference
- Open5GS
- Denial of service
- Memory corruption
- CVSS 5.3 Medium
Open5GS PFCP Session Report Request n4-handler.c smf_n4_handle_session_report_request assertion
- Open5GS
- Denial of service
- CVSS 6.9 Medium
Open5GS PFCP Message handler.c denial of service
- Open5GS
- Denial of service
- CVSS 6.9 Medium
Open5GS Old AMF Discovery Fallback nnrf-handler.c amf_nnrf_try_old_amf_discovery_fallback use after free
- Open5GS
- Memory corruption
- CVSS 5.3 Medium
Open5GS AMF/MME improper authorization
- Open5GS
- Privilege escalation
- Broken access control
- CVSS 5.3 Medium
Open5GS SMF nudm-handler.c smf_nudm_sdm_handle_get assertion
- Open5GS
- Denial of service
- CVSS 5.3 Medium
Open5GS N1-N2 Message namf-handler.c amf_namf_comm_handle_n1_n2_message_transfer denial of service
- Open5GS
- Denial of service
- CVSS 5.3 Medium
Open5GS Transfer Endpoint namf-handler.c null pointer dereference
- Open5GS
- Denial of service
- Memory corruption
- CVSS 5.3 Medium
Open5GS AMF namf-handler.c amf_namf_comm_decode_ue_mm_context_list memory corruption
- Open5GS
- Memory corruption
- CVSS 5.3 Medium
Open5GS HSS hss-cx-path.c assertion
- Open5GS
- Denial of service
- CVSS 5.3 Medium
Open5GS AMF UEContextReleaseRequest Path improper authorization
- Open5GS
- Privilege escalation
- Broken access control
- CVSS 5.3 Medium
Open5GS Rx AA-Request pcrf-rx-path.c pcrf_rx_aar_cb out-of-bounds
- Open5GS
- Memory corruption
- CVSS 5.3 Medium
Open5GS S6a Authentication-Information-Request hss-s6a-path.c hss_ogs_diam_s6a_air_cb heap-based overflow
- Open5GS
- Memory corruption
- CVSS 5.3 Medium
Open5GS SMF Diameter Gx Credit-Control-Answer smf_gx_cca_cb denial of service
- Open5GS
- Denial of service
- CVSS 5.3 Medium
Open5GS HSS Service fd_msg_sess_get denial of service
- Open5GS
- Denial of service
- CVSS 5.3 Medium
Open5GS freeDiameter memory corruption
- Open5GS
- Memory corruption
- CVSS 6.9 Medium
Open5GS CER init.c diam_log_func assertion
- Open5GS
- Denial of service
- CVSS 5.3 Medium
Open5GS Diameter Rx pcrf-rx-path.c pcrf_rx_aar_cb buffer overflow
- Open5GS
- Memory corruption
- CVSS 5.3 Medium
Open5GS Diameter S6a mme-fd-path.c mme_s6a_subscription_data_from_avp heap-based overflow
- Open5GS
- Memory corruption
- CVSS 5.3 Medium
Open5GS Diameter S6a hss-s6a-path.c hss_ogs_diam_s6a_ulr_cb stack-based overflow
- Open5GS
- Memory corruption
- CVSS 8.6 High
Pre-auth heap out-of-bounds read in the AMF NAS 5GS mobile-identity handler
- open5gs
- Memory corruption
- CVSS 4.8 Medium
Open5GS AMF context.c amf_context_final use after free
- Open5GS
- Memory corruption
- CVSS 5.3 Medium
Open5GS AMF nnrf-handler.c amf_nnrf_handle_nf_discover denial of service
- Open5GS
- Denial of service
- CVSS 2.3 Low
Open5GS NGAP Handover gmm-sm.c gmm_state_security_mode race condition
- Open5GS
- Race condition
- CVSS 6.9 Medium
Open5GS NGAP PathSwitchRequest Message ngap-handler.c improper authentication
- Open5GS
- Authentication bypass
- CVSS 5.3 Medium
Open5GS nf-instances Endpoint nnrf-handler.c handle_amf_info resource consumption
- Open5GS
- Denial of service
- CVSS 5.3 Medium
Open5GS nghttp2-server.c ogs_pool_id_calloc denial of service
- Open5GS
- Denial of service
- CVSS 5.3 Medium
Open5GS ue-authentications Endpoint ogs-timer.c ogs_sbi_xact_add denial of service
- Open5GS
- Denial of service
- CVSS 5.3 Medium
Open5GS Shared NF-profile nnrf-handler.c denial of service
- Open5GS
- Denial of service
- CVSS 5.3 Medium
Open5GS Shared NF-profile nnrf-handler.c handle_scp_info out-of-bounds write
- Open5GS
- Memory corruption
- CVSS 5.3 Medium
Open5GS Shared NF-profile nnrf-handler.c denial of service
- Open5GS
- Denial of service
- CVSS 5.3 Medium
Open5GS NRF nghttp2-server.c discover_handler use after free
- Open5GS
- Memory corruption
- CVSS 5.3 Medium
Open5GS AUSF nausf-handler.c ogs_timer_add denial of service
- Open5GS
- Denial of service
- CVSS 5.3 Medium
Open5GS NRF context.c ogs_sbi_nf_service_add denial of service
- Open5GS
- Denial of service
- CVSS 5.3 Medium
Open5GS AMF/MME context.c ran_ue_find_by_amf_ue_ngap_id improper authorization
- Open5GS
- Privilege escalation
- Broken access control
- CVSS 5.3 Medium
Open5GS NRF client.c ogs_sbi_client_add denial of service
- Open5GS
- Denial of service
- CVSS 5.3 Medium
Open5GS NRF context.c ogs_sbi_nf_instance_set_id denial of service
- Open5GS
- Denial of service
- CVSS 5.3 Medium
Open5GS NRF message.c denial of service
- Open5GS
- Denial of service
- CVSS 5.3 Medium
Open5GS NRF conv.c ogs_sbi_discovery_option_parse_plmn_list denial of service
- Open5GS
- Denial of service
- CVSS 5.3 Medium
Open5GS NRF conv.c yuarel_parse denial of service
- Open5GS
- Denial of service
- CVSS 5.3 Medium
Open5GS NRF nnrf-handler.c ogs_nnrf_nfm_handle_nf_profile denial of service
- Open5GS
- Denial of service
- CVSS 5.3 Medium
Open5GS SMF nsmf-handler.c smf_nsmf_handle_update_data_in_vsmf denial of service
- Open5GS
- Denial of service
- CVSS 5.3 Medium
Open5GS SMF nsmf-handler.c smf_nsmf_handle_update_data_in_vsmf denial of service
- Open5GS
- Denial of service
- CVSS 5.3 Medium
Open5GS SMF gsm-handler.c denial of service
- Open5GS
- Denial of service
- CVSS 5.3 Medium
Open5GS SMF ogs_nas_parse_qos_rules denial of service
- Open5GS
- Denial of service
- CVSS 5.3 Medium
Open5GS SMF smf_nsmf_handle_create_sm_context denial of service
- Open5GS
- Denial of service
- CVSS 5.3 Medium
Open5GS SMF OpenAPI_list_create denial of service
- Open5GS
- Denial of service
- CVSS 5.3 Medium
Open5GS SMF smf_nsmf_handle_created_data_in_vsmf denial of service
- Open5GS
- Denial of service
- CVSS 5.3 Medium
Open5GS SMF gsm-build.c gsm_build_pdu_session_establishment_accept denial of service
- Open5GS
- Denial of service
- CVSS 5.3 Medium
Open5GS SMF smf_nsmf_handle_create_data_in_hsmf null pointer dereference
- Open5GS
- Denial of service
- Memory corruption
- CVSS 5.3 Medium
Open5GS SMF npcf-handler.c update_authorized_pcc_rule_and_qos denial of service
- Open5GS
- Denial of service
- CVSS 5.3 Medium
Open5GS SMF n4-build.c smf_n4_build_qos_flow_to_modify_list denial of service
- Open5GS
- Denial of service
- CVSS 5.3 Medium
Open5GS SMF npcf-handler.c update_authorized_pcc_rule_and_qos denial of service
- Open5GS
- Denial of service
- CVSS 5.3 Medium
Open5GS SMF npcf-handler.c update_authorized_pcc_rule_and_qos denial of service
- Open5GS
- Denial of service