# Open5GS vulnerabilities Source: https://junglewise.ai/threats/technologies/open5gs Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 12 November 2026, 00:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/open5gs.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 85 vulnerabilities in Open5GS: 0 in the last 7 days and 24 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-106806, was published on 2 November 2026. 3 vulnerabilities in the last four weeks, down 57% on the four before (7). ## Counts - Last 7 days: 0 - Last 30 days: 3 - Last 90 days: 24 - All time: 85 (0 critical, 0 exploited in the wild) ## About Open5GS Open-source 5G core network software implementing 3GPP standards for mobile network infrastructure. ## Latest Open5GS vulnerabilities - [CVE-2026-106806: Open5GS HTTP/2 SBI server memory exhaustion](https://junglewise.ai/threats/cve-2026-106806-a-memory-exhaustion-issue-exists-in-open5gs-v2-8-0-in-the-http-2) (info, published 2 Nov 2026) - [CVE-2026-106807: open5GS PFCP transaction handling denial of service](https://junglewise.ai/threats/cve-2026-106807-a-denial-of-service-vulnerability-exists-in-open5gs-v2-8-0-in) (info, published 2 Nov 2026) - [CVE-2026-116543: Open5GS heap out-of-bounds write in multipart parsing](https://junglewise.ai/threats/cve-2026-116543-open5gs-1-3-0-through-2-8-0-contains-a-heap-out-of-bounds-write) (high, CVSS 7.5, published 26 Oct 2026) - [CVE-2026-108105: Open5GS assertion failure in SGSN context request handling](https://junglewise.ai/threats/cve-2026-108105-open5gs-through-2-8-0-contains-a-reachable-assertion) (medium, CVSS 5.9, published 9 Oct 2026) - [CVE-2026-108103: Open5GS heap out-of-bounds read in PFCP parsing](https://junglewise.ai/threats/cve-2026-108103-open5gs-through-2-8-0-contains-a-heap-out-of-bounds-read) (medium, CVSS 5.3, published 9 Oct 2026) - [CVE-2026-108102: Open5GS heap out-of-bounds read in PFCP parsing](https://junglewise.ai/threats/cve-2026-108102-open5gs-through-2-8-0-contains-a-heap-out-of-bounds-read) (medium, CVSS 5.3, published 9 Oct 2026) - [CVE-2026-92417: Open5GS null pointer dereference in PFCP handler](https://junglewise.ai/threats/cve-2026-92417-open5gs-null-pointer-dereference-in-pfcp-handler) (medium, CVSS 6.5, published 16 Sep 2026) - [CVE-2026-92416: Open5GS assertion failure in PFCP Session Report Request handling](https://junglewise.ai/threats/cve-2026-92416-open5gs-assertion-failure-in-pfcp-session-report-request-handling) (medium, CVSS 4.3, published 16 Sep 2026) - [CVE-2026-91855: Open5GS PFCP Message Handler assertion failure in FAR validation](https://junglewise.ai/threats/cve-2026-91855-open5gs-pfcp-message-handler-assertion-failure-in-far-validation) (medium, CVSS 5.3, published 15 Sep 2026) - [CVE-2026-90707: Open5GS use-after-free in AMF discovery fallback](https://junglewise.ai/threats/cve-2026-90707-open5gs-use-after-free-in-amf-discovery-fallback) (high, CVSS 8.3, published 14 Sep 2026) - [CVE-2026-86212: Open5GS improper authorization in AMF/MME](https://junglewise.ai/threats/cve-2026-86212-open5gs-improper-authorization-in-amf-mme) (medium, CVSS 4.3, published 6 Sep 2026) - [CVE-2026-75438: Open5GS buffer overflow in time parsing](https://junglewise.ai/threats/cve-2026-75438-open5gs-buffer-overflow-in-time-parsing) (high, CVSS 7.5, published 4 Sep 2026) - [CVE-2026-82590: Open5GS SMF assertion denial of service in QoS handling](https://junglewise.ai/threats/cve-2026-82590-open5gs-smf-assertion-denial-of-service-in-qos-handling) (medium, CVSS 4.3, published 30 Aug 2026) - [CVE-2026-82589: Open5GS denial of service in N1-N2 message handler](https://junglewise.ai/threats/cve-2026-82589-open5gs-denial-of-service-in-n1-n2-message-handler) (medium, CVSS 4.3, published 30 Aug 2026) - [CVE-2026-82588: Open5GS null pointer dereference in AMF Transfer Endpoint](https://junglewise.ai/threats/cve-2026-82588-open5gs-null-pointer-dereference-in-amf-transfer-endpoint) (medium, CVSS 4.3, published 30 Aug 2026) - [CVE-2026-82587: Open5GS AMF memory corruption in UE MM context decoding](https://junglewise.ai/threats/cve-2026-82587-open5gs-amf-memory-corruption-in-ue-mm-context-decoding) (medium, CVSS 4.3, published 30 Aug 2026) - [CVE-2026-37198: Open5GS SMF integer overflow in GTP packet handling](https://junglewise.ai/threats/cve-2026-37198-open5gs-smf-integer-overflow-in-gtp-packet-handling) (high, CVSS 7.5, published 27 Aug 2026) - [CVE-2026-30047: Open5GS reachable assertion in SM context handling](https://junglewise.ai/threats/cve-2026-30047-open5gs-reachable-assertion-in-sm-context-handling) (high, CVSS 7.5, published 27 Aug 2026) - [CVE-2026-30046: Open5GS NUDM-UECM reachable assertion denial of service](https://junglewise.ai/threats/cve-2026-30046-open5gs-nudm-uecm-reachable-assertion-denial-of-service) (high, CVSS 7.5, published 27 Aug 2026) - [CVE-2026-30045: Open5GS integer overflow in /nnrf-disc/v1/nf-instances](https://junglewise.ai/threats/cve-2026-30045-open5gs-integer-overflow-in-nnrf-disc-v1-nf-instances) (high, CVSS 7.5, published 27 Aug 2026) - [CVE-2026-78186: Open5GS HSS assertion denial of service in User-Name validation](https://junglewise.ai/threats/cve-2026-78186-open5gs-hss-assertion-denial-of-service-in-user-name-validation) (medium, CVSS 4.3, published 24 Aug 2026) - [CVE-2026-78158: Open5GS AMF UEContextReleaseRequest improper authorization in RAN ownership](https://junglewise.ai/threats/cve-2026-78158-open5gs-amf-uecontextreleaserequest-improper-authorization-in-ran) (medium, CVSS 6.3, published 24 Aug 2026) - [CVE-2026-78157: Open5GS Rx AA-Request Handler out-of-bounds read](https://junglewise.ai/threats/cve-2026-78157-open5gs-rx-aa-request-handler-out-of-bounds-read) (high, CVSS 7.4, published 24 Aug 2026) - [CVE-2026-78156: Open5GS heap-based buffer overflow in S6a handler](https://junglewise.ai/threats/cve-2026-78156-open5gs-heap-based-buffer-overflow-in-s6a-handler) (high, CVSS 7.4, published 24 Aug 2026) - [CVE-2025-15687: Open5GS denial of service in SMF Diameter Gx Credit-Control-Answer](https://junglewise.ai/threats/cve-2025-15687-open5gs-denial-of-service-in-smf-diameter-gx-credit-control) (medium, CVSS 4.3, published 12 Aug 2026) ## Most severe Open5GS vulnerabilities - [CVE-2026-15720: Open5GS heap out-of-bounds read in AMF NAS 5GS handler](https://junglewise.ai/threats/cve-2026-15720-open5gs-heap-out-of-bounds-read-in-amf-nas-5gs-handler) (high, CVSS 8.6, published 14 Jul 2026) - [CVE-2026-90707: Open5GS use-after-free in AMF discovery fallback](https://junglewise.ai/threats/cve-2026-90707-open5gs-use-after-free-in-amf-discovery-fallback) (high, CVSS 8.3, published 14 Sep 2026) - [CVE-2026-75438: Open5GS buffer overflow in time parsing](https://junglewise.ai/threats/cve-2026-75438-open5gs-buffer-overflow-in-time-parsing) (high, CVSS 7.5, published 4 Sep 2026) - [CVE-2026-37198: Open5GS SMF integer overflow in GTP packet handling](https://junglewise.ai/threats/cve-2026-37198-open5gs-smf-integer-overflow-in-gtp-packet-handling) (high, CVSS 7.5, published 27 Aug 2026) - [CVE-2026-30045: Open5GS integer overflow in /nnrf-disc/v1/nf-instances](https://junglewise.ai/threats/cve-2026-30045-open5gs-integer-overflow-in-nnrf-disc-v1-nf-instances) (high, CVSS 7.5, published 27 Aug 2026) - [CVE-2026-30047: Open5GS reachable assertion in SM context handling](https://junglewise.ai/threats/cve-2026-30047-open5gs-reachable-assertion-in-sm-context-handling) (high, CVSS 7.5, published 27 Aug 2026) - [CVE-2026-30046: Open5GS NUDM-UECM reachable assertion denial of service](https://junglewise.ai/threats/cve-2026-30046-open5gs-nudm-uecm-reachable-assertion-denial-of-service) (high, CVSS 7.5, published 27 Aug 2026) - [CVE-2025-65559: An issue was discovered in Open5GS 2.7.5-49-g465e90f, when processing a PFCP Session Establishment Request (type=50)…](https://junglewise.ai/threats/cve-2025-65559-an-issue-was-discovered-in-open5gs-2-7-5-49-g465e90f-when) (high, CVSS 7.5, published 18 Dec 2025) - [CVE-2025-41067: Reachable Assertion vulnerability in Open5GS up to version 2.7.6 allows attackers with connectivity to the NRF to cause a…](https://junglewise.ai/threats/cve-2025-41067-reachable-assertion-vulnerability-in-open5gs-up-to-version-2-7-6) (high, CVSS 7.5, published 27 Oct 2025) - [CVE-2025-41068: Reachable Assertion vulnerability in Open5GS up to version 2.7.6 allows attackers with connectivity to the NRF to cause a…](https://junglewise.ai/threats/cve-2025-41068-reachable-assertion-vulnerability-in-open5gs-up-to-version-2-7-6) (high, CVSS 7.5, published 27 Oct 2025) ## Vulnerabilities per week 3 vulnerabilities in the last four weeks, down 57% on the four before (7). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 12 | 0 | 0 | | 31 Aug 2026 | 2 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 4 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 3 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 1 | 0 | 0 | | 2 Nov 2026 | 2 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Open5GS vulnerabilities", https://junglewise.ai/threats/technologies/open5gs, 12 November 2026.