EUVD-2026-26468Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was found in Open5GS up to 2.7.7. This affects the function amf_namf_comm_handle_registration_status_update_request in the library /lib/app/ogs-init.c of the file /namf-comm/v1/ue-contexts/{ueContextId}/transfer-update. Performing a manipulation of the argument ueContextId results in denial of service. The attack can be initiated remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Denial of service in Open5GS up to version 2.7.7 allows authenticated remote attackers to crash the AMF (Access and Mobility Function) service by manipulating the ueContextId parameter in the UE context transfer-update endpoint, resulting in service unavailability. Public exploit code is available but the vendor has not issued a patch or official response despite early notification.
Technical ContextAI
Open5GS is an open-source 5G core network implementation. The vulnerability exists in the AMF (Access and Mobility Function) component, specifically in the registration status update request handler located in /lib/app/ogs-init.c. The vulnerable endpoint is /namf-comm/v1/ue-contexts/{ueContextId}/transfer-update, which handles UE (User Equipment) context management in the 5G core network. The CWE-404 classification (improper resource validation/handling) indicates the root cause is insufficient validation of the ueContextId parameter before processing, likely leading to null pointer dereference, out-of-bounds access, or resource exhaustion when malformed or non-existent context identifiers are supplied.
RemediationAI
No vendor-released patch is currently available given the project's lack of response per the CVE description. Immediate mitigations include: (1) Upgrade to a version beyond 2.7.7 if available from the Open5GS repository; however, this must be verified given no official patch information is provided; (2) Restrict network access to the NAMF service endpoints, particularly /namf-comm/v1/ue-contexts/{ueContextId}/transfer-update, using firewall rules or API gateway policies to limit exposure to trusted UE identities or authenticated subscribers only; (3) Monitor AMF service logs and metrics for unexpected crashes or high failure rates on the transfer-update endpoint, and implement automated alerting to detect exploitation attempts; (4) Implement input validation and parameter sanitization at the load-balancer or reverse proxy level to reject obviously malformed ueContextId values before they reach the AMF service. If the Open5GS project remains unresponsive, consider reporting to relevant 5G standards bodies (3GPP) or your telecommunications regulator, as critical infrastructure may depend on vendor accountability. Reference the issue at https://github.com/open5gs/open5gs/issues/4399 for any future vendor updates.
Same weakness CWE-404 – Improper Resource Shutdown or Release
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today