—Go
GO-2026-5717· CVE-2026-44320, GHSA-wqfh-gq79-j8mffree5GC's NEF nnef-callback route group is unauthenticated; forged callback requests are accepted into the processing path in github.com/free5gc/nef
Modified: 6/25/2026
package
Go/github.com/free5gc/nef
pkg:go/github.com/free5gc/nef
—Go
GO-2026-5642· CVE-2026-44330, GHSA-rwww-x45w-p52wfree5GC's NEF nnef-pfdmanagement API is unauthenticated; forged bearer tokens can read PFD data and create/delete PFD subscriptions in github.com/free5gc/nef
Modified: 6/25/2026
—Go
GO-2026-5647· CVE-2026-44319, GHSA-rxrq-fv76-26prfree5GC's NEF crashes via logger.Fatal on PFD notification delivery failure (attacker-controlled notifyUri) in github.com/free5gc/nef
Modified: 6/25/2026
CRITICAL9.4Go
GHSA-3p28-73q7-45xp· CVE-2026-44326, GO-2026-5093free5GC's NEF 3gpp-traffic-influence API is unauthenticated; missing or forged bearer tokens can create, read, patch, and delete subscriptions
Modified: 6/25/2026
CRITICAL9.4Go
GHSA-5f62-53r8-qrqf· CVE-2026-44315, GO-2026-5142free5GC's NEF 3gpp-pfd-management API is unauthenticated; forged bearer tokens can create, read, and delete PFD transactions
Modified: 6/25/2026
CRITICAL10.0Go
GHSA-cmpj-2x3g-m7g3· CVE-2026-44327, GO-2026-5326free5GC's NEF nnef-oam route group is unauthenticated; no-token requests reach the OAM handler
Modified: 7/21/2026
HIGH7.5Go
GHSA-j59f-x285-69jx· CVE-2026-44322, GO-2026-5447free5GC's NEF 3gpp-pfd-management PATCH applications/{appId} panics on UDR access failure due to nil ProblemDetails dereference
Modified: 6/25/2026
CRITICAL10.0Go
GHSA-rwww-x45w-p52w· CVE-2026-44330, GO-2026-5642free5GC's NEF nnef-pfdmanagement API is unauthenticated; forged bearer tokens can read PFD data and create/delete PFD subscriptions
Modified: 6/25/2026
HIGH7.5Go
GHSA-rxrq-fv76-26pr· CVE-2026-44319, GO-2026-5647free5GC's NEF crashes via logger.Fatal on PFD notification delivery failure (attacker-controlled notifyUri)
Modified: 6/25/2026
HIGH7.3Go
GHSA-wqfh-gq79-j8mf· CVE-2026-44320, GO-2026-5717free5GC's NEF nnef-callback route group is unauthenticated; forged callback requests are accepted into the processing path
Modified: 6/25/2026
—Go
GO-2026-5093· CVE-2026-44326, GHSA-3p28-73q7-45xpfree5GC's NEF 3gpp-traffic-influence API is unauthenticated; missing or forged bearer tokens can create, read, patch, and delete subscriptions in github.com/free5gc/nef
Modified: 6/25/2026
—Go
GO-2026-5142· CVE-2026-44315, GHSA-5f62-53r8-qrqffree5GC's NEF 3gpp-pfd-management API is unauthenticated; forged bearer tokens can create, read, and delete PFD transactions in github.com/free5gc/nef
Modified: 6/25/2026
—Go
GO-2026-5326· CVE-2026-44327, GHSA-cmpj-2x3g-m7g3free5GC's NEF nnef-oam route group is unauthenticated; no-token requests reach the OAM handler in github.com/free5gc/nef
Modified: 6/25/2026
—Go
GO-2026-5447· CVE-2026-44322, GHSA-j59f-x285-69jxfree5GC's NEF 3gpp-pfd-management PATCH applications/{appId} panics on UDR access failure due to nil ProblemDetails dereference in github.com/free5gc/nef
Modified: 6/25/2026