EUVD-2026-33457
GHSA-v3ph-7v5f-jmgp
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was identified in Open5GS up to 2.7.7. This affects an unknown part in the library lib/sbi/nnrf-handler.c of the component Shared NF-profile Parser. Such manipulation leads to denial of service. The attack can be launched remotely. The exploit is publicly available and might be used. It is advisable to implement a patch to correct this issue.
AnalysisAI
Denial-of-service via reachable assertion in Open5GS NRF (Network Repository Function) up to version 2.7.7 allows an authenticated low-privilege network peer to crash the NRF process with SIGABRT by submitting a crafted NFProfile registration payload with oversized inner-list arrays in SMF or AMF info sections. The NRF is a critical singleton service registry in 5G Service-Based Architecture - crashing it disrupts NF discovery for the entire 5G core, making the practical operational impact greater than the A:L CVSS impact rating alone suggests. Publicly available exploit code exists (GitHub issue #4469 and CVSS temporal E:P), though no confirmed active exploitation via CISA KEV has been recorded at time of analysis.
Technical ContextAI
Open5GS is an open-source 5G core network stack implementing 3GPP Release 15/16 specifications. The NRF handles NF instance registration and discovery via the Nnrf_NFManagement HTTP/2 JSON interface in the 5G Service-Based Architecture (SBA). The vulnerable code in lib/sbi/nnrf-handler.c parses NFProfile JSON payloads during NF registration. Two distinct sites are affected: (1) handle_smf_info() uses ogs_assert(dnn_index < OGS_MAX_NUM_OF_DNN) as a bounds guard on the per-slice DNN array; when a peer submits an SMF NFProfile with more than 16 DNN entries in a single S-NSSAI slice, the assertion fires SIGABRT rather than handling the overflow gracefully. (2) handle_amf_info() has the same pattern for tac_index against OGS_MAX_NUM_OF_TAI in the TAC range inner-loop, confirmed by PR #4527 comments referencing GitHub issues #4467 and #4470. CWE-404 (Improper Resource Shutdown or Release) is assigned; the assertion crash constitutes improper handling of resource exhaustion without clean shutdown. The affected CPE is cpe:2.3:a:n/a:open5gs:*:*:*:*:*:*:*:*.
RemediationAI
The primary fix is to apply the upstream patch from GitHub PR #4527 (https://github.com/open5gs/open5gs/pull/4527), which replaces the crashing ogs_assert() calls in both handle_smf_info() and handle_amf_info() with graceful bounds checks, and adds a nfprofile_inner_lists_overflow() pre-validation function in src/nrf/nnrf-handler.c that rejects oversized NFProfile registrations with HTTP 400 Bad Request before they reach the parser. The upstream fix is confirmed via PR #4527, but the exact Open5GS tagged release version incorporating this fix was not independently confirmed from the provided data - operators should verify the specific patched release tag on the Open5GS GitHub repository (https://github.com/open5gs/open5gs/) before deploying. As a compensating control prior to patching, restrict access to the NRF's Nnrf_NFManagement registration endpoint to trusted, known NF instances using network-level ACLs or mTLS certificate pinning, preventing untrusted or compromised peers from submitting crafted NFProfiles - note this may affect legitimate NF onboarding procedures and should be coordinated with operations teams. Isolating the SBA internal network from external access reduces exposure surface but does not address the vulnerability if internal NF peers are compromised.
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
open5gs v2.6.4 is vulnerable to Buffer Overflow. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
Open5GS v2.6.4 is vulnerable to Buffer Overflow. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
A request-validation issue was discovered in Open5GS 2.1.3 through 2.2.x before 2.2.1. Rated critical severity (CVSS 9.8
Memory corruption in Open5GS versions through 2.7.1 is remotely exploitable via the freeDiameter protocol component, all
Open5GS 2.1.3 listens on 0.0.0.0:3000 and has a default password of 1423 for the admin account. Rated high severity (CVS
Open5GS MME versions <= 2.6.4 contain a reachable assertion in the `Uplink NAS Transport` packet handler. Rated high sev
Open5GS MME version <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the
Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the
Open5GS MME versions <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the
Same weakness CWE-404 – Improper Resource Shutdown or Release
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today