EUVD-2026-71769
GHSA-wvgr-2cq4-w5p5
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SBI endpoint accepts unauthenticated network input; crash impact is availability-only with no confidentiality or integrity effect.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
7DescriptionCVE.org
Buffer Overflow vulnerability in Open5GS v2.7.7 allows a remote attacker to cause a denial of service via the ogs_sbi_time_parse() function
AnalysisAI
Remote unauthenticated denial-of-service against Open5GS v2.7.7 is possible by sending a crafted HTTP/2 SBI request containing an overlong timestamp string to the Session Management Function. The ogs_sbi_time_from_string() function in lib/sbi/conv.c copies characters into a fixed-size buffer using loop counters j and k without checking bounds, triggering a buffer overflow that crashes the SMF process and disrupts all active and new PDU sessions. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The Open5GS SMF Service Based Interface (HTTP/2) must be reachable by the attacker - in a correctly deployed 5G standalone core this interface sits on an internal network segment, but research testbeds and misconfigured deployments may expose it externally. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.5 score (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) is well-calibrated: the SBI endpoint is network-reachable, requires no authentication, and the sole impact is crashing the SMF - a complete availability loss for all UEs served by that node. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the upstream fix commit 7227b2f5b254160286798e058c189224360d99fc available at https://github.com/open5gs/open5gs/commit/7227b2f5b254160286798e058c189224360d99fc. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Immediately inventory all Open5GS deployments and identify instances running v2.7.7; verify network accessibility of the SBI (Service-Based Interface) endpoint from untrusted networks. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
open5gs v2.6.4 is vulnerable to Buffer Overflow. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
Open5GS v2.6.4 is vulnerable to Buffer Overflow. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
A request-validation issue was discovered in Open5GS 2.1.3 through 2.2.x before 2.2.1. Rated critical severity (CVSS 9.8
Memory corruption in Open5GS versions through 2.7.1 is remotely exploitable via the freeDiameter protocol component, all
Open5GS 2.1.3 listens on 0.0.0.0:3000 and has a default password of 1423 for the admin account. Rated high severity (CVS
Open5GS MME versions <= 2.6.4 contain a reachable assertion in the `Uplink NAS Transport` packet handler. Rated high sev
Open5GS MME version <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the
Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the
Open5GS MME versions <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the
Same weakness CWE-120 – Classic Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today