EUVD-2026-94412
GHSA-qv2w-h32m-r96m
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote, low-complexity, unauthenticated GTP-U packets reach the UPF (AV:N/AC:L/PR:N/UI:N); impact is a partial resource-exhaustion/crash DoS only, so C:N/I:N and A:L.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A weakness has been identified in Open5GS up to 2.7.7. This vulnerability affects the function ogs_pfcp_xact_local_create of the file src/upf/gtp-path.c of the component GTP-U Receive Path. This manipulation causes allocation of resources. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. Patch name: 9ffc252482d9b03ac01abcedbe95497ff4f95dd0. It is recommended to apply a patch to fix this issue.
AnalysisAI
Denial of service in Open5GS up to and including 2.7.7: an unanswerable or failing PFCP Session Report path triggered from the GTP-U receive code causes the UPF (and the parallel SGW-U path) to abort or to leak PFCP transaction objects, degrading or halting user-plane service. The flaw is CWE-770 uncontrolled resource allocation in the GTP-U receive path (src/upf/gtp-path.c, ogs_pfcp_xact_local_create) and is remotely reachable without authentication or user interaction (CVSS:3.1 AV:N/AC:L/PR:N/UI:N), though in a correctly segmented 5G core the N3/GTP-U socket is exposed only to the access network (gNB) rather than the public internet. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network reachability to the Open5GS UPF (or SGW-U) GTP-U / N3 user-plane socket, which in a correctly segmented 5G core is only exposed to the access network (gNB) rather than the public internet; the attacker must be able to inject GTP-U packets that reach the affected PFCP session-report code path in src/upf/gtp-path.c (and the parallel sgwu path). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a medium-severity denial-of-service issue (CWE-770, uncontrolled resource allocation) in the Open5GS UPF/SGW-U GTP-U receive path, not a high-impact priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the upstream fix: upgrade Open5GS past the affected 2.7.7 code level using the merged patch, i.e. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
open5gs v2.6.4 is vulnerable to Buffer Overflow. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
Open5GS v2.6.4 is vulnerable to Buffer Overflow. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
A request-validation issue was discovered in Open5GS 2.1.3 through 2.2.x before 2.2.1. Rated critical severity (CVSS 9.8
Memory corruption in Open5GS versions through 2.7.1 is remotely exploitable via the freeDiameter protocol component, all
Open5GS 2.1.3 listens on 0.0.0.0:3000 and has a default password of 1423 for the admin account. Rated high severity (CVS
Open5GS MME versions <= 2.6.4 contain a reachable assertion in the `Uplink NAS Transport` packet handler. Rated high sev
Open5GS MME version <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the
Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the
Open5GS MME versions <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today