EUVD-2026-30690
GHSA-pch7-6gr4-gw9w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconObtain NRF SBI credentials
-
DeliveryConnect to NRF registration endpoint
-
ExploitSend crafted NFProfile with oversized service arrays
-
InstallExhaust nf_service pool
-
C2Trigger assertion failure
-
ExecuteNRF process termination
-
Impact5G service discovery failure
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Resource release
|
| Exploitation Conditions | Requires valid authentication credentials to access Open5GS NRF SBI (PR:L in CVSS vector). Attack targets the NF registration endpoint, which is network-accessible (AV:N) within the 5G core management plane. No special NRF configuration or feature enablement required beyond default SBI interface exposure. Exploitation limited to environments where attacker has compromised at least one registered network function with SBI credentials, or has insider access to the 5G core control plane. Does not affect deployments using alternative 5G core implementations or those with NRF instances protected by strict network segmentation preventing lateral movement from compromised network functions. |
| Impact | Real-world risk is moderate despite low CVSS 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L). Attack requires authenticated access (PR:L) to the NRF SBI, limiting exposure to compromised network functions or malicious insiders in 5G deployments. Low attack complexity (AC:L) and network vector (AV:N) mean any authenticated entity can trigger the DoS. Impact is limited to availability (A:L) of a single NRF instance, though NRF failure disrupts service discovery for the entire 5G core. Public exploit code (E:P confirmed via GitHub issue #4466) significantly increases likelihood of opportunistic attacks. Not in CISA KEV, indicating no evidence of widespread active exploitation. SSVC framework: Exploitation=POC, Automatable=Yes (simple resource exhaustion), Technical Impact=Partial (DoS only). Priority depends on deployment context - critical for production 5G cores with limited NRF redundancy, lower for lab/test environments with rapid recovery capability. Patch available (RL:O) and attack requires authentication, making this a medium-priority remediation for most organizations, high-priority for telco production environments. |
| Exploit ScenarioDerived | Attacker with valid credentials for 5G core SBI (compromised AMF/SMF/UPF or malicious network function) connects to NRF endpoint and sends crafted NFProfile registration messages containing excessive nfServices or nfServiceList arrays. Each service entry consumes one slot from the fixed nf_service pool. After pool exhaustion, next allocation triggers ogs_assert() failure, terminating the NRF process. 5G core loses service discovery capability, preventing network functions from locating each other. Public exploit code in GitHub issue #4466 demonstrates attack method. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 17, 2026
Denial of service in Open5GS NRF (Network Repository Function) allows authenticated remote attackers to crash the service by exhausting the nf_service resource pool. Open5GS versions up to 2.7.7 fail to validate pool allocation during NF service registration, triggering assertion failures that terminate the process. Publicly available exploit code exists (GitHub issue #4466). EPSS data not available, not listed in CISA KEV. Patch released via commit 819db11a08b9736a3576c4f99ceb28f7eb99523a, merged in PR #4534.
RemediationAI
Apply vendor-released patch by upgrading to Open5GS commit 819db11a08b9736a3576c4f99ceb28f7eb99523a or later, merged via pull request https://github.com/open5gs/open5gs/pull/4534. Patch replaces ogs_assert() with null-pointer checks and graceful error handling, truncating excessive NF service registrations instead of crashing. If immediate patching is infeasible, implement compensating controls: (1) Increase nf_service pool capacity in Open5GS configuration to delay exhaustion (trade-off: higher memory consumption), (2) Rate-limit NF registration requests at network perimeter using firewall rules or API gateway (trade-off: may impact legitimate burst registrations during network recovery), (3) Restrict NRF SBI access to authenticated network functions only via mTLS certificate validation (reduces attack surface but requires PKI infrastructure), (4) Deploy redundant NRF instances with load balancing to maintain service availability during single-instance failures (trade-off: increased operational complexity). Monitor nf_service pool utilization via Open5GS metrics to detect exhaustion attempts before impact.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Open5GS implements 5G core network functions including NRF (Network Repository Function), responsible for service discovery and registration. The vulnerability exists in /lib/sbi/context.c functions ogs_sbi_subscription_data_add and ogs_sbi_nf_service_add, which allocate NF service objects from a fixed-size pool. The code uses ogs_assert() to validate allocations, a pattern that triggers process termination rather than graceful error handling when the pool is exhausted. CWE-404 (Improper Resource Shutdown or Release) applies because the service fails to handle resource exhaustion safely. The SBI (Service Based Interface) context manages 5G service registrations using pre-allocated memory pools with configurable capacity (ogs_app()->pool.nf_service). When parsing NFProfile messages containing nfServices or nfServiceList arrays, the code allocated pool objects without checking for exhaustion until after ogs_assert(), making the service vulnerable to resource exhaustion attacks.
Know when Open5gs gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was determined in Open5GS up to 2.7.7. Affected is the function ogs_sbi_subscription_data_add/ogs_sbi_nf_service_add in the library /lib/sbi/context.c of the component NRF. Executing a manipulation can lead to denial of service. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. This patch is called 819db11a08b9736a3576c4f99ceb28f7eb99523a. A patch should be applied to remediate this issue.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
open5gs v2.6.4 is vulnerable to Buffer Overflow. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
Open5GS v2.6.4 is vulnerable to Buffer Overflow. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
A request-validation issue was discovered in Open5GS 2.1.3 through 2.2.x before 2.2.1. Rated critical severity (CVSS 9.8
Memory corruption in Open5GS versions through 2.7.1 is remotely exploitable via the freeDiameter protocol component, all
Open5GS 2.1.3 listens on 0.0.0.0:3000 and has a default password of 1423 for the admin account. Rated high severity (CVS
Open5GS MME versions <= 2.6.4 contain a reachable assertion in the `Uplink NAS Transport` packet handler. Rated high sev
Open5GS MME version <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the
Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the
Open5GS MME versions <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the
Exploit-DB