EUVD-2026-33458
GHSA-xq3q-8wc9-jgfc
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
A security flaw has been discovered in Open5GS up to 2.7.7. This vulnerability affects the function ogs_sbi_xact_add in the library /lib/core/ogs-timer.c of the component ue-authentications Endpoint. Performing a manipulation results in denial of service. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. Applying a patch is the recommended action to fix this issue.
AnalysisAI
Timer pool exhaustion in Open5GS up to 2.7.7 allows an authenticated remote attacker with low privileges to crash the UE authentication service via rapid HTTP/2 stream resets against the ue-authentications SBI endpoint. The root cause is CWE-404: response timers for outbound SBI transactions are not released when the originating inbound HTTP/2 stream closes prematurely (via RST_STREAM or connection drop), causing the timer pool to exhaust when a peer resets streams rapidly while upstream network functions are slow or unresponsive. No public exploit identified at time of analysis as KEV status, but a publicly available exploit code exists via GitHub issue #4473, and an upstream fix is available in PR #4578.
Technical ContextAI
Open5GS is an open-source 5G core network implementation that implements the 3GPP Service-Based Interface (SBI) using HTTP/2. The vulnerable component is the SBI transaction management layer in lib/sbi/context.c (function ogs_sbi_xact_remove) and the MHD and nghttp2 server backends. When an NF (Network Function) receives an inbound HTTP/2 stream for UE authentication, it may initiate an outbound SBI transaction (e.g., to an NRF for discovery) that carries a response timer. CWE-404 (Improper Resource Shutdown or Release) manifests because when the inbound stream closes prematurely - via RST_STREAM or connection teardown - the outbound transaction's timer slot is NOT returned to the pool immediately; it is held until the SBI client wait timeout expires. Under rapid stream-reset conditions with a slow upstream NF, timer pool slots accumulate faster than they are reclaimed, eventually exhausting the pool and making the ue-authentications endpoint unavailable. The fix in PR #4578 introduces per-stream transaction tracking (to_stream_list / to_stream_node linkage in ogs_sbi_xact_t) so that stream_remove_xact_all() can drain and cancel all attached transactions in O(1) at stream close time. CPE: cpe:2.3:a:n/a:open5gs:*:*:*:*:*:*:*:*.
RemediationAI
The upstream fix is available as GitHub PR #4578 (https://github.com/open5gs/open5gs/pull/4578); however, a tagged release version incorporating this patch has not been independently confirmed from the available data - operators should monitor the Open5GS release page for a patched release beyond 2.7.7 and upgrade as soon as one is published. As a compensating control while awaiting a patched release, restrict network access to the SBI plane (ue-authentications endpoint) to trusted internal NFs and authenticated clients only, using network-layer ACLs or firewall rules to prevent untrusted or external sources from issuing HTTP/2 RST_STREAM floods - this does not eliminate the vulnerability but significantly raises the bar for exploitation by requiring the attacker to already hold low-privilege credentials and network access. Additionally, consider configuring rate limiting on HTTP/2 stream creation and reset rates at the load balancer or reverse proxy in front of the AMF SBI interface, which can throttle the stream-reset volume needed to exhaust the timer pool. Note that the trade-off of SBI access restriction may affect inter-NF communication in tightly integrated environments; validate that legitimate NF-to-NF traffic is not inadvertently blocked.
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
open5gs v2.6.4 is vulnerable to Buffer Overflow. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
Open5GS v2.6.4 is vulnerable to Buffer Overflow. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
A request-validation issue was discovered in Open5GS 2.1.3 through 2.2.x before 2.2.1. Rated critical severity (CVSS 9.8
Memory corruption in Open5GS versions through 2.7.1 is remotely exploitable via the freeDiameter protocol component, all
Open5GS 2.1.3 listens on 0.0.0.0:3000 and has a default password of 1423 for the admin account. Rated high severity (CVS
Open5GS MME versions <= 2.6.4 contain a reachable assertion in the `Uplink NAS Transport` packet handler. Rated high sev
Open5GS MME version <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the
Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the
Open5GS MME versions <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the
Same weakness CWE-404 – Improper Resource Shutdown or Release
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today