# free5GC vulnerabilities Source: https://junglewise.ai/threats/technologies/free5gc Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/free5gc.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 29 vulnerabilities in free5GC: 0 in the last 7 days and 19 in the last 90 days, 2 of them critical and 0 exploited in the wild. The most recent, CVE-2026-106805, was published on 2 November 2026. 1 vulnerability in the last four weeks, level on the four before (1). ## Counts - Last 7 days: 0 - Last 30 days: 1 - Last 90 days: 19 - All time: 29 (2 critical, 0 exploited in the wild) ## About free5GC Open-source 5G core network implementation. ## Latest free5GC vulnerabilities - [CVE-2026-106805: Free5GC SMF resource exhaustion in PFCP session establishment](https://junglewise.ai/threats/cve-2026-106805-a-resource-exhaustion-issue-exists-in-free5gc-v4-2-3-during-pfcp) (info, published 2 Nov 2026) - [CVE-2026-94043: Free5GC race condition in GMM handler RanUe context access](https://junglewise.ai/threats/cve-2026-94043-a-vulnerability-was-determined-in-free5gc-up-to-4-2-3-this) (medium, CVSS 5.3, published 20 Sep 2026) - [CVE-2026-75439: Free5GC UPF nil pointer dereference in PFCP Session Report](https://junglewise.ai/threats/cve-2026-75439-free5gc-upf-nil-pointer-dereference-in-pfcp-session-report) (high, CVSS 7.5, published 4 Sep 2026) - [CVE-2026-55068: free5GC NRF input validation bypass in NF profile registration](https://junglewise.ai/threats/cve-2026-55068-free5gc-nrf-input-validation-bypass-in-nf-profile-registration) (critical, CVSS 4, published 28 Aug 2026) - [CVE-2026-30073: free5gc NSSF nil pointer dereference in NssaiAvailabilitySubscriptionCreate](https://junglewise.ai/threats/cve-2026-30073-free5gc-nssf-nil-pointer-dereference-in) (high, CVSS 7.5, published 27 Aug 2026) - [CVE-2026-30071: free5gc RechargePut denial of service in input parsing](https://junglewise.ai/threats/cve-2026-30071-free5gc-rechargeput-denial-of-service-in-input-parsing) (high, CVSS 7.5, published 27 Aug 2026) - [CVE-2026-30070: free5GC UDM HandleGetSharedData denial of service](https://junglewise.ai/threats/cve-2026-30070-free5gc-udm-handlegetshareddata-denial-of-service) (high, CVSS 7.5, published 27 Aug 2026) - [CVE-2026-30069: free5GC NULL pointer dereference in UDMC registration handler](https://junglewise.ai/threats/cve-2026-30069-free5gc-null-pointer-dereference-in-udmc-registration-handler) (high, CVSS 7.5, published 27 Aug 2026) - [CVE-2026-30068: free5GC UDM improper input validation in parameter provisioning](https://junglewise.ai/threats/cve-2026-30068-free5gc-udm-improper-input-validation-in-parameter-provisioning) (high, CVSS 7.5, published 27 Aug 2026) - [CVE-2026-30067: free5gc NRF Discovery denial of service in complexQueryFilterSubprocess](https://junglewise.ai/threats/cve-2026-30067-free5gc-nrf-discovery-denial-of-service-in) (high, CVSS 7.5, published 27 Aug 2026) - [CVE-2026-30064: free5gc OAuth2 token endpoint denial of service via unmatched form key](https://junglewise.ai/threats/cve-2026-30064-free5gc-oauth2-token-endpoint-denial-of-service-via-unmatched) (high, CVSS 7.5, published 27 Aug 2026) - [CVE-2026-30063: free5gc NF Discovery endpoint denial of service via malformed snssais parameter](https://junglewise.ai/threats/cve-2026-30063-free5gc-nf-discovery-endpoint-denial-of-service-via-malformed) (high, CVSS 7.5, published 27 Aug 2026) - [CVE-2026-30062: free5gc NGAP handler denial of service via malformed NAS PDU](https://junglewise.ai/threats/cve-2026-30062-free5gc-ngap-handler-denial-of-service-via-malformed-nas-pdu) (high, CVSS 7.5, published 27 Aug 2026) - [CVE-2026-30059: free5gc NAS decoder denial of service in 5GSID validation](https://junglewise.ai/threats/cve-2026-30059-free5gc-nas-decoder-denial-of-service-in-5gsid-validation) (high, CVSS 7.5, published 27 Aug 2026) - [CVE-2026-30058: free5gc AMF denial of service in HTTPModifySubscription](https://junglewise.ai/threats/cve-2026-30058-free5gc-amf-denial-of-service-in-httpmodifysubscription) (high, CVSS 7.5, published 27 Aug 2026) - [CVE-2026-30057: free5gc AMF CreateUEContext denial of service via multipart deserialization](https://junglewise.ai/threats/cve-2026-30057-free5gc-amf-createuecontext-denial-of-service-via-multipart) (high, CVSS 7.5, published 27 Aug 2026) - [CVE-2026-30056: free5gc AMF NGAP Dispatcher NULL pointer dereference](https://junglewise.ai/threats/cve-2026-30056-free5gc-amf-ngap-dispatcher-null-pointer-dereference) (high, CVSS 7.5, published 27 Aug 2026) - [CVE-2026-30051: free5gc AMF denial of service via crafted UE context request](https://junglewise.ai/threats/cve-2026-30051-free5gc-amf-denial-of-service-via-crafted-ue-context-request) (high, CVSS 7.5, published 27 Aug 2026) - [CVE-2026-30050: free5gc ModifyAMFEventSubscriptionProcedure denial of service via negative array index](https://junglewise.ai/threats/cve-2026-30050-free5gc-modifyamfeventsubscriptionprocedure-denial-of-service-via) (high, CVSS 7.5, published 27 Aug 2026) - [CVE-2026-53551: free5gc AUSF improper input validation in supiOrSuci field](https://junglewise.ai/threats/cve-2026-53551-free5gc-ausf-improper-input-validation-in-supiorsuci-field) (medium, CVSS 4, published 31 Jul 2026) - [CVE-2026-44315: free5GC NEF missing authorization in 3gpp-pfd-management API](https://junglewise.ai/threats/cve-2026-44315-free5gc-nef-missing-authorization-in-3gpp-pfd-management-api) (critical, CVSS 9.4, published 27 May 2026) - [CVE-2026-42083: free5GC PCF missing authorization in SMPolicyControl and UEPolicyControl](https://junglewise.ai/threats/cve-2026-42083-free5gc-pcf-missing-authorization-in-smpolicycontrol-and) (high, CVSS 8.2, published 27 May 2026) - [CVE-2026-41136: free5GC AMF: Missing default case in Content-Type switch in HTTPUEContextTransfer](https://junglewise.ai/threats/cve-2026-41136-free5gc-amf-missing-default-case-in-content-type-switch-in) (medium, CVSS 5.3, published 22 Apr 2026) - [CVE-2026-41135: free5GC PCF: Memory Leak via CORS Middleware Registration in HTTP Handler Leads to Denial of Service](https://junglewise.ai/threats/cve-2026-41135-free5gc-pcf-memory-leak-via-cors-middleware-registration-in-http) (high, CVSS 7.5, published 22 Apr 2026) - [CVE-2026-40343: free5GC UDR: Fail-open handling in PolicyDataSubsToNotifyPost allows unintended subscription creation](https://junglewise.ai/threats/cve-2026-40343-free5gc-udr-fail-open-handling-in-policydatasubstonotifypost) (medium, CVSS 5.8, published 22 Apr 2026) ## Most severe free5GC vulnerabilities - [CVE-2026-44315: free5GC NEF missing authorization in 3gpp-pfd-management API](https://junglewise.ai/threats/cve-2026-44315-free5gc-nef-missing-authorization-in-3gpp-pfd-management-api) (critical, CVSS 9.4, published 27 May 2026) - [CVE-2026-55068: free5GC NRF input validation bypass in NF profile registration](https://junglewise.ai/threats/cve-2026-55068-free5gc-nrf-input-validation-bypass-in-nf-profile-registration) (critical, CVSS 4, published 28 Aug 2026) - [CVE-2026-42083: free5GC PCF missing authorization in SMPolicyControl and UEPolicyControl](https://junglewise.ai/threats/cve-2026-42083-free5gc-pcf-missing-authorization-in-smpolicycontrol-and) (high, CVSS 8.2, published 27 May 2026) - [CVE-2026-75439: Free5GC UPF nil pointer dereference in PFCP Session Report](https://junglewise.ai/threats/cve-2026-75439-free5gc-upf-nil-pointer-dereference-in-pfcp-session-report) (high, CVSS 7.5, published 4 Sep 2026) - [CVE-2025-65562: The free5GC UPF suffers from a lack of bounds checking on the SEID when processing PFCP Session Deletion Requests. An…](https://junglewise.ai/threats/cve-2025-65562-the-free5gc-upf-suffers-from-a-lack-of-bounds-checking-on-the) (high, CVSS 7.5, published 18 Dec 2025) - [CVE-2026-41135: free5GC PCF: Memory Leak via CORS Middleware Registration in HTTP Handler Leads to Denial of Service](https://junglewise.ai/threats/cve-2026-41135-free5gc-pcf-memory-leak-via-cors-middleware-registration-in-http) (high, CVSS 7.5, published 22 Apr 2026) - [CVE-2026-30073: free5gc NSSF nil pointer dereference in NssaiAvailabilitySubscriptionCreate](https://junglewise.ai/threats/cve-2026-30073-free5gc-nssf-nil-pointer-dereference-in) (high, CVSS 7.5, published 27 Aug 2026) - [CVE-2026-30071: free5gc RechargePut denial of service in input parsing](https://junglewise.ai/threats/cve-2026-30071-free5gc-rechargeput-denial-of-service-in-input-parsing) (high, CVSS 7.5, published 27 Aug 2026) - [CVE-2026-30070: free5GC UDM HandleGetSharedData denial of service](https://junglewise.ai/threats/cve-2026-30070-free5gc-udm-handlegetshareddata-denial-of-service) (high, CVSS 7.5, published 27 Aug 2026) - [CVE-2026-30069: free5GC NULL pointer dereference in UDMC registration handler](https://junglewise.ai/threats/cve-2026-30069-free5gc-null-pointer-dereference-in-udmc-registration-handler) (high, CVSS 7.5, published 27 Aug 2026) ## Vulnerabilities per week 1 vulnerability in the last four weeks, level on the four before (1). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 16 | 1 | 0 | | 31 Aug 2026 | 1 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 1 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 1 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other free5GC technologies - [free5GC Nef](https://junglewise.ai/threats/technologies/nef): 7 vulnerabilities - [free5GC Udr](https://junglewise.ai/threats/technologies/udr): 7 vulnerabilities - [free5GC Pcf](https://junglewise.ai/threats/technologies/pcf): 4 vulnerabilities - [free5GC NRF](https://junglewise.ai/threats/technologies/nrf): 3 vulnerabilities - [free5GC SMF](https://junglewise.ai/threats/technologies/smf): 3 vulnerabilities - [free5GC Udm](https://junglewise.ai/threats/technologies/udm): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "free5GC vulnerabilities", https://junglewise.ai/threats/technologies/free5gc, 13 November 2026.