Open5GS CVE-2025-46115

Primary remediation requires monitoring the Open5GS GitHub repository (https://github.com/open5gs/open5gs) for a patch release addressing issue #3858, as no fixed version number is confirmed in available vendor advisories at time of analysis. Until an official patch is released, implement these specific compensating controls: (1) Deploy network-level filtering to restrict PDU Session Management messages to only trusted 5G RAN equipment using IPsec or TLS mutual authentication on N1/N2 interfaces, accepting the operational overhead of certificate management. (2) Enable strict input validation logging on SMF to detect malformed PDU Session Modification Requests and implement rate-limiting per UE (User Equipment) identifier to contain potential DoS impact, though this may introduce latency during legitimate high-volume session modifications. (3) Deploy SMF instances in high-availability clusters with health monitoring to enable automatic failover if a node crashes, which increases infrastructure cost but maintains service continuity. (4) For lab/test environments, isolate Open5GS deployments from production networks entirely and restrict access to authenticated VPN connections only. Subscribe to security notifications at https://github.com/open5gs/open5gs/security/advisories for official patch announcements.