Search results

[Bugs] UPF crashes with nil pointer dereference when processing Session Report Response for a deleted PFCP session

Status: Open.

#1059 In free5gc/free5gc;

· hackeryounow opened on Jun 4, 2026

[Bugs]NRF nnrf-nfm lacks NF Profile input validation — enables NF Registration Poisoning with arbitrary service endpoints

Status: Open.

#1056 In free5gc/free5gc;

· 980448499-mm opened on May 27, 2026

[Bugs]Nil pointer dereference in AMF NGAP handler via UplinkRANConfigurationTransfer

Status: Open.

#1049 In free5gc/free5gc;

· nightmare462 opened on May 6, 2026

[Bugs] AMF UEContextTransfer consumer JsonData nil dereference (cross-AMF mobility)

Status: Open.

#1045 In free5gc/free5gc;

· LinZiyuu opened on May 2, 2026

[Bugs] MultiNF openapi getContentID L292 FieldByName panic

Status: Open.

#1041 In free5gc/free5gc;

· LinZiyuu opened on Apr 27, 2026

[Bugs] MultiNF openapi getContentID L267 zero reflect value panic

Status: Open.

#1040 In free5gc/free5gc;

· LinZiyuu opened on Apr 27, 2026

[Bugs] UDM generate-auth-data nil sequenceNumber panic

Status: Open.

#1037 In free5gc/free5gc;

· LinZiyuu opened on Apr 27, 2026

[Bugs] AUSF decodeEapAkaPrime index out-of-bounds panic

Status: Open.

#1030 In free5gc/free5gc;

· LinZiyuu opened on Apr 27, 2026

[Bugs] Missing Concurrent NAS SMC Validation During NGAP Handover

AMF

Status: Open.

Bug

#1021 In free5gc/free5gc;

· SJNA0414 opened on Apr 20, 2026

[Bugs] UE Security Capability bypass on NGAP PathSwitchRequest

AMF

Status: Open.

Bug

#1020 In free5gc/free5gc;

· SJNA0414 opened on Apr 20, 2026

[Bugs] TNGF accumulates stale IKE Security Associations indefinitely due to missing INFORMATIONAL handler and absent SA cleanup, enabling pre-authentication remote DoS

TNGF

Status: Open.

Bug

#1000 In free5gc/free5gc;

· LinZiyuu opened on Apr 6, 2026

[Bugs] TNGF: IKE Message ID not validated, allowing replay of DELETE/CREATE_CHILD_SA messages

TNGF

Status: Open.

Bug

#995 In free5gc/free5gc;

· LinZiyuu opened on Apr 5, 2026