Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
free5GC NRF (Docker image free5gc-fuzz:latest) accepts NF registration requests without validating any field constraints against 3GPP TS 29.510, allowing unauthenticated attackers to inject fake NF profiles with arbitrary service endpoint IP addresses. All 17 constraint violations tested (UUID format, enum values, numeric ranges, mandatory fields, IP endpoint integrity) were accepted with HTTP 200/201. Legitimate NFs discover these fake profiles via NFDiscover and route control-plane traffic to attacker-controlled endpoints, an attacker with SBI network access can intercept control-plane signaling, harvest OAuth2 credentials, and deny service to subscribers. --- Details free5GC NRF's RegisterNFInstance handler (PUT /nnrf-nfm/v1/nf-instances/{nfInstanceID}) accepts the full NF profile body without field-level validation. The following 3GPP TS 29.510 constraints are violated: Format validation: nfInstanceId accepts non-UUID strings (e.g., "not-a-uuid",…
Recommended action: Upgrade to 4.2.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The free5GC AUSF (Authentication Server Function) does not validate the supiOrSuci field in UE authentication requests. Null bytes (\x00) and other control characters pass through JSON parsing unchanged and are forwarded to the UDM in an unescaped URL path. This causes Go's net/url.Parse() to fail, returning HTTP 500 "System failure" and leaking internal stack traces. An unauthenticated attacker can trigger this at scale—4.1% of specialchars mutations produce HTTP 500—causing denial of service for all subscribers attempting authentication through the affected AUSF. CWE-20 (Improper Input Validation). --- Details The vulnerability lies in the AUSF's POST /nausf-auth/v1/ue-authentications handler. The JSON body includes a supiOrSuci field: The AUSF parses this JSON (Go's encoding/json accepts null bytes in strings per RFC 8259), then constructs a UDM URL by directly embedding the raw supiOrSuci value: When supiOrSuci contains null bytes (\x00), the resulting URL is illegal…
Recommended action: Upgrade to 4.2.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.