EUVD-2026-33452
GHSA-p769-7pg7-jx7m
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was found in Open5GS up to 2.7.7. Affected by this vulnerability is an unknown functionality in the library lib/sbi/nnrf-handler.c of the component Shared NF-profile Parser. The manipulation results in denial of service. It is possible to launch the attack remotely. The exploit has been made public and could be used. A patch should be applied to remediate this issue.
AnalysisAI
Denial of service in Open5GS NRF (Network Repository Function) through version 2.7.7 allows an authenticated network peer to crash the NRF process with SIGABRT by submitting a crafted SMF or AMF NF-profile registration containing oversized inner-loop arrays. The NRF's shared NF-profile parser in lib/sbi/nnrf-handler.c used reachable ogs_assert() calls - rather than graceful bounds checks - to enforce limits on DNN entries per S-NSSAI slice and TAC range entries per TAI range, making them triggerable by peer-supplied payloads. Publicly available exploit code exists (GitHub issue #4467); the CVSSv4 score of 2.1 reflects scoped low-availability impact but understates operational risk given the NRF's central role in 5G core service discovery.
Technical ContextAI
Open5GS is an open-source 5G core network implementation implementing the 3GPP Service-Based Architecture (SBA). The vulnerability resides in lib/sbi/nnrf-handler.c within handle_smf_info() and handle_amf_info(), functions that parse NF-profile registration payloads received over the Nnrf_NFManagement SBI interface. The root cause maps to CWE-404 (Improper Resource Shutdown or Release): the parser enforced array bounds using ogs_assert() - which calls abort() on failure - rather than conditional break logic. When a registering SMF supplies an S-NSSAI slice with more than OGS_MAX_NUM_OF_DNN (16) DNN entries, or an AMF supplies a TAI range with more than OGS_MAX_NUM_OF_TAI TAC range entries, the assertion fires and the NRF terminates with SIGABRT. The affected CPE is cpe:2.3:a:n/a:open5gs:*:*:*:*:*:*:*:*. The fix in PR #4527 replaces both assert sites with bounds-checked break conditions and adds a pre-validation function nfprofile_inner_lists_overflow() in src/nrf/nnrf-handler.c that rejects offending NFProfiles with HTTP 400 before they reach the parser.
RemediationAI
Apply the upstream fix from GitHub PR #4527 (https://github.com/open5gs/open5gs/pull/4527), which replaces the reachable ogs_assert() bounds checks in handle_smf_info() and handle_amf_info() with graceful break-on-overflow logic and adds the nfprofile_inner_lists_overflow() pre-validator in src/nrf/nnrf-handler.c that returns HTTP 400 Bad Request for oversized NFProfiles before they enter the parser. A vendor-tagged release incorporating this fix has not been independently confirmed from available references - the fix exists as an upstream GitHub PR commit, so operators must build from the patched commit or monitor the Open5GS release page for a tagged version exceeding 2.7.7. As an interim compensating control, restrict access to the NRF's SBI Nnrf_NFManagement registration endpoint to known, trusted internal NF peers using network segmentation or mutual TLS client certificate enforcement; this reduces the pool of principals that can submit crafted NFProfile payloads but does not eliminate the vulnerability if a trusted NF is compromised.
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
open5gs v2.6.4 is vulnerable to Buffer Overflow. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
Open5GS v2.6.4 is vulnerable to Buffer Overflow. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
A request-validation issue was discovered in Open5GS 2.1.3 through 2.2.x before 2.2.1. Rated critical severity (CVSS 9.8
Memory corruption in Open5GS versions through 2.7.1 is remotely exploitable via the freeDiameter protocol component, all
Open5GS 2.1.3 listens on 0.0.0.0:3000 and has a default password of 1423 for the admin account. Rated high severity (CVS
Open5GS MME versions <= 2.6.4 contain a reachable assertion in the `Uplink NAS Transport` packet handler. Rated high sev
Open5GS MME version <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the
Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the
Open5GS MME versions <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the
Same weakness CWE-404 – Improper Resource Shutdown or Release
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today