EUVD-2026-33472
GHSA-5fc4-7q74-93x4
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability was determined in Open5GS up to 2.7.7. This affects the function handle_amf_info in the library /lib/sbi/nnrf-handler.c of the component nf-instances Endpoint. Executing a manipulation of the argument nf_info_pool can lead to resource consumption. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. Applying a patch is advised to resolve this issue. The issue report is flagged as already-fixed.
AnalysisAI
Uncontrolled resource consumption in Open5GS up to version 2.7.7 allows remote low-privileged attackers to degrade availability of the NRF (Network Repository Function) component by sending crafted requests to the nf-instances SBI endpoint. The vulnerability triggers runaway resource allocation through the nf_info_pool argument in the handle_amf_info function, resulting in a denial-of-service condition against the NRF's NF instance registration and discovery services. A publicly available proof-of-concept exploit exists (E:P in CVSS 4.0 vector), though no public exploit identified at time of analysis has been confirmed by CISA KEV; the upstream issue is flagged as already-fixed.
Technical ContextAI
Open5GS is an open-source implementation of 5G Core network functions and LTE EPC, widely used in research, private networks, and testbed deployments. The affected code path is the handle_amf_info() function within /lib/sbi/nnrf-handler.c, which processes AMF (Access and Mobility Management Function) registration data at the NRF's nf-instances Service-Based Interface (SBI) endpoint - the REST-like interface 5G core NFs use to register themselves and query peer NF profiles. CWE-400 (Uncontrolled Resource Consumption) is the root cause class, indicating that the nf_info_pool data structure is allocated or grown without adequate bounds checking, rate limiting, or quota enforcement when malformed or adversarially sized NF profile data is submitted. Because the NRF is a hub component - all other 5G NFs depend on it for discovery - resource exhaustion here has outsized architectural significance despite the low CVSS severity score.
RemediationAI
Upstream fix available (issue flagged as already-fixed per VulDB report); however, the exact patched release version is not independently confirmed from available data - no tagged release or formal vendor advisory with a specific fix version was referenced. Monitor https://github.com/open5gs/open5gs/ for a tagged release beyond 2.7.7 and upgrade as soon as one is available. As a compensating control prior to patching, restrict network access to the NRF SBI nf-instances endpoint to only trusted, known-good NF clients via firewall or service mesh policy - this directly limits the population of principals who can trigger the vulnerability (PR:L means authentication is required, so tightening credential issuance and endpoint exposure reduces risk). Implement request-rate limiting or payload-size caps on the nf-instances SBI endpoint to prevent nf_info_pool exhaustion; note that overly aggressive rate limits may interfere with legitimate NF registration during scale-up events. Monitor NRF process memory and resource utilization for anomalous growth as a detection control.
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today