EUVD-2026-30677
GHSA-cgrm-wwh5-v7w8
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
A security vulnerability has been detected in Open5GS up to 2.7.7. The impacted element is the function ogs_sbi_discovery_option_parse_plmn_list in the library /lib/sbi/conv.c of the component NRF. Such manipulation of the argument target-plmn-list leads to denial of service. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Denial of service in Open5GS versions up to 2.7.7 allows authenticated remote attackers to crash the Network Repository Function (NRF) component via malformed target-plmn-list parameters. The vulnerability targets a parsing function in the Service-Based Interface (SBI) library and has publicly available exploit code (GitHub issue #4458). CVSS 4.3 reflects low severity, but the vendor has not responded to early disclosure attempts, leaving no confirmed patch timeline. EPSS and KEV data unavailable - exploitation likelihood beyond POC unknown.
Technical ContextAI
Open5GS is an open-source implementation of 5G core network functions. The vulnerability resides in ogs_sbi_discovery_option_parse_plmn_list function within /lib/sbi/conv.c, part of the NRF (Network Repository Function) component responsible for service discovery in 5G Service-Based Architecture. The flaw is classified as CWE-404 (Improper Resource Shutdown or Release), indicating the parser fails to properly handle malformed PLMN (Public Land Mobile Network) list data structures in SBI requests. This causes resource exhaustion or unhandled exceptions leading to process termination. The SBI uses HTTP/2-based RESTful APIs per 3GPP specifications, and the target-plmn-list parameter is part of the NF (Network Function) discovery service query format.
RemediationAI
No vendor-released patch identified at time of analysis - the RL:X CVSS modifier and GitHub issue #4458 indicate early disclosure attempts received no vendor response. Monitor the official Open5GS GitHub repository (https://github.com/open5gs/open5gs/) for future commits addressing issue #4458 and subscribe to release notifications for post-2.7.7 versions. Compensating controls for production deployments: (1) Implement strict input validation on NRF SBI ingress via reverse proxy or API gateway, filtering malformed target-plmn-list parameters before reaching Open5GS - requires custom WAF rules based on 3GPP TS 29.510 PLMN list format specifications, may block legitimate edge-case queries. (2) Enforce mutual TLS authentication between all network functions and NRF with certificate-based access control to reduce attack surface from PR:L to PR:H equivalent, preventing compromised low-privilege NFs from exploiting NRF - operational overhead of PKI management. (3) Deploy NRF in high-availability configuration with health-check-based failover to limit service disruption from DoS crashes - does not prevent exploitation but contains impact. (4) Network segmentation: isolate NRF on dedicated management VLAN with ingress filtering allowing only registered NF source IPs - limits lateral movement exploitation but requires static NF inventory. All mitigations are workarounds with operational trade-offs; vendor patch remains the primary long-term solution.
open5gs v2.6.4 is vulnerable to Buffer Overflow. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
Open5GS v2.6.4 is vulnerable to Buffer Overflow. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
A request-validation issue was discovered in Open5GS 2.1.3 through 2.2.x before 2.2.1. Rated critical severity (CVSS 9.8
Open5GS 2.1.3 listens on 0.0.0.0:3000 and has a default password of 1423 for the admin account. Rated high severity (CVS
Open5GS MME versions <= 2.6.4 contain a reachable assertion in the `Uplink NAS Transport` packet handler. Rated high sev
Open5GS MME version <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the
Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the
Open5GS MME versions <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the
Open5GS MME versions <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the
Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the
Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the
Open5GS MME versions <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the
Same weakness CWE-404 – Improper Resource Shutdown or Release
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today