EUVD-2026-26727Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
7DescriptionCVE.org
A vulnerability has been found in Open5GS up to 2.7.6. Affected is an unknown function of the file src/amf/gmm-handler.c of the component AMF. The manipulation of the argument reg_type leads to denial of service. The attack is possible to be carried out remotely. Upgrading to version 2.7.7 is able to address this issue. The identifier of the patch is ebc66942b6f8f1fab2d640e71cf4e9f1a423b426. It is advisable to upgrade the affected component.
AnalysisAI
Denial of service in Open5GS AMF (Access and Mobility Function) up to version 2.7.6 allows authenticated remote attackers to cause service unavailability by sending crafted registration requests with manipulated reg_type arguments. The vulnerability exists in the GMM (Mobility Management) handler due to insufficient validation of registration type values, potentially triggering null pointer dereferences or assertion failures. Vendor-released patch version 2.7.7 is available.
Technical ContextAI
Open5GS is an open-source implementation of 5G core network functions. The vulnerability affects the AMF component, specifically the gmm-handler.c file which processes NAS (Non-Access Stratum) registration requests from UEs (User Equipment). The root cause is CWE-404 (Improper Resource Validation), where registration_type values are not properly normalized or validated before use in subsequent logic. The patch (commit ebc66942b6f8f1fab2d640e71cf4e9f1a423b426) adds normalization logic to ensure unused or invalid registration-type encodings are converted to the INITIAL registration type per 3GPP TS 24.501 specification, and implements additional assertions to prevent null pointer dereferences in context transfer operations. The vulnerability involves the reg_type parameter passed during 5G registration procedures, which if malformed or set to unexpected values, causes unhandled conditions in the AMF's state machine.
RemediationAI
Upgrade Open5GS to version 2.7.7 or later immediately, as vendor-released patch is available per https://github.com/open5gs/open5gs/releases/tag/v2.7.7. The patch implements registration type normalization (converting invalid reg_type values to INITIAL per 3GPP TS 24.501) and adds defensive assertions to prevent null pointer dereferences in context transfer logic. No workarounds are documented for versions prior to 2.7.7. Operators unable to upgrade immediately should consider restricting AMF access to trusted UEs only via network segmentation or disabling context transfer features (N14 interface) if operationally feasible, though these are not recommended permanent solutions. Monitor AMF logs for assertion failures or crashes related to gmm_handle_registration_request() as an interim detection measure.
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
open5gs v2.6.4 is vulnerable to Buffer Overflow. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
Open5GS v2.6.4 is vulnerable to Buffer Overflow. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
A request-validation issue was discovered in Open5GS 2.1.3 through 2.2.x before 2.2.1. Rated critical severity (CVSS 9.8
Memory corruption in Open5GS versions through 2.7.1 is remotely exploitable via the freeDiameter protocol component, all
Open5GS 2.1.3 listens on 0.0.0.0:3000 and has a default password of 1423 for the admin account. Rated high severity (CVS
Open5GS MME versions <= 2.6.4 contain a reachable assertion in the `Uplink NAS Transport` packet handler. Rated high sev
Open5GS MME version <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the
Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the
Open5GS MME versions <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the
Same weakness CWE-404 – Improper Resource Shutdown or Release
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today