Open5GS EUVD-2026-109913

Trigger requires sending a multipart/related request whose multipart boundary is empty (a body of the CRLFCRLF form, ~30 bytes) to the SBI (Service Based Interface) listener of any Open5GS network function; default configuration is sufficient and the official open5gs:2.8.0 container reproduces as-is. No authentication is needed (PR:N) because ogs_sbi_parse_request dispatches to the parser before any access-token check. The key LIMITING factor is network position: the advisory states this is NOT Internet-exposed-unauthenticated - SEPP N32 inter-operator traffic is HTTPS with a client CA - so the attacker must be able to reach the internal core SBI network plane. Impact is confined to availability (NF crash/restart); it does not yield data disclosure or code execution.

All signals converge on a credible but bounded threat. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms a network-reachable, low-complexity, pre-authentication trigger, matching the GHSA narrative that any unauthenticated peer on the SBI plane can crash a network function with a single ~30-byte request. Crucially, impact is isolated to availability (VC:N/VI:N/VA:H): the advisory assesses this as DoS-only - the out-of-bounds write is a fixed periodic pattern into talloc-isolated objects with glibc safe-linking in effect, and code execution is explicitly 'not demonstrated and not claimed.' This is therefore a genuine priority as an availability/resilience issue for 5G core operators, not a high-CVSS-but-trivial problem, but it is not an RCE. Mitigating the urgency: KEV status is NOT present (no confirmed active exploitation), no EPSS score was supplied (exploitation probability cannot be quantified from the input), and the vendor/VulnCheck advisory scopes exposure to peers on the internal core SBI network - it is explicitly 'not Internet-exposed unauthenticated' since SEPP N32 inter-operator traffic uses HTTPS with a client CA. The vuln.today decision label is 'this_week' (not act_now/emergency), consistent with a serious internal-plane DoS rather than a mass-exploitation event. Net: treat as a prompt-patch availability flaw for exposed core networks; the blast radius depends heavily on how well the SBI plane is network-segmented.

An attacker with reachability to an Open5GS network function's SBI port (e.g., a compromised host or rogue function on the core service mesh, since the SBI plane is internal rather than Internet-facing) sends a single crafted HTTP POST with Content-Type multipart/related and an empty boundary. The empty boundary is never length-checked, so the parser's lookbehind buffer index grows without bound and writes past its heap allocation, crashing the target NF with a SIGSEGV before any authentication check. The GHSA documents a reproducible PoC methodology (confirmed with ASan on the real object file), but the complete self-contained exploit is held privately and only available on request.