What is the CVSS score of EUVD-2026-44343?

EUVD-2026-44343 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H. EPSS exploitation probability: 0.4%.

Which versions of Open5GS are affected by EUVD-2026-44343?

Open5GS 5G core platform versions through 2.7.7 contain an unauthenticated denial-of-service vulnerability in the AMF (mobility management component) exploitable before user authentication, allowing…

How to fix or mitigate EUVD-2026-44343?

Within 24 hours: Immediately inventory all Open5GS deployments running versions through 2.7.7, assess network exposure to untrusted sources, and enable detailed logging and alerting for malformed NAS pre-authentication messages on all AMF instances. Within 7 days: Implement network segmentation to restrict AMF access from untrusted networks via firewall rules, deploy rate limiting on pre-authentication message processing, and test active failover and redundancy mechanisms to validate service resilience under DoS conditions. Within 30 days: Monitor open5gs.org and vendor security advisories for patch availability; prepare and validate a tested upgrade procedure to deploy the patched version immediately upon release; conduct a comprehensive business continuity review to ensure acceptable recovery time objectives if AMF components become unavailable.

Open5GS EUVD-2026-44343

| CVE-2026-15720 HIGH

Out-of-bounds Read (CWE-125)

2026-07-14 redhat-cnalr

GHSA-2vfm-v289-h559

Buffer Overflow Denial Of Service Information Disclosure Open5gs

8.6

CVSS 3.1 · Vendor: redhat-cnalr

Severity by source

Vendor (redhat-cnalr) PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

vuln.today AI

8.6 HIGH

Pre-authentication, no privileges or interaction (PR:N/UI:N), reachable over the network NAS interface with low complexity; crash of the AMF impacts all subscribers (S:C, A:H) with no confidentiality or integrity effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

Primary rating from Vendor (redhat-cnalr).

CVSS VectorVendor: redhat-cnalr

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 20:09 vuln.today

CVE Published

Jul 14, 2026 - 18:20 cve.org

HIGH 8.6

DescriptionCVE.org

In Open5GS through version 2.7.7 a pre-authentication heap out-of-bounds read in the AMF NAS 5GS mobile-identity handler may result in subscriber-wide denial of service.

AnalysisAI

Denial of service in Open5GS (open-source 5G/EPC core) through version 2.7.7 lets remote unauthenticated attackers crash the AMF by sending a malformed NAS 5GS mobile-identity information element, triggering a heap out-of-bounds read before authentication completes. Because the AMF handles mobility management for the entire network, a single crafted pre-authentication message can produce a subscriber-wide outage rather than affecting only the sender. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV, but the pre-auth network-reachable nature makes it a high-priority availability issue for anyone running Open5GS in production.

Technical ContextAI

Open5GS is a widely-used open-source implementation of the 3GPP 4G EPC and 5G Core; the affected component is the AMF (Access and Mobility Management Function), which terminates the NAS (Non-Access Stratum) 5GS signaling from user equipment over the N1/N2 path. The vulnerability lives in the handler that parses the 5GS mobile-identity IE (which conveys SUCI/SUPI/GUTI/IMEI-style identities) during initial registration, before the subscriber is authenticated. The root cause is CWE-125 (out-of-bounds read): the parser trusts an attacker-controlled length or type field and reads past the bounds of a heap buffer, corrupting parser state or dereferencing invalid memory and crashing the AMF process. The single CPE cpe:2.3:a:open5gs:open5gs:*:*:*:*:*:*:*:* confirms all versions up to and including 2.7.7 of the open5gs package are in scope.

RemediationAI

Upgrade to a fixed Open5GS release as directed by the vendor advisory GHSA-f4mx-3x6p-cfwp (https://github.com/open5gs/open5gs/security/advisories/GHSA-f4mx-3x6p-cfwp) - patch available per vendor advisory, but no exact fixed version number was included in the provided data, so confirm the patched tag directly from that advisory and the Open5GS release notes before deploying. Until patched, restrict reachability of the AMF NAS/N2 signaling interface: ensure the 5G core control plane is on an isolated management/signaling network not reachable from untrusted UE or internet-facing segments, and enforce that only trusted, authenticated gNBs peer with the AMF over N2 (the trade-off is that this does not stop a malicious or compromised UE that already has RAN access). Consider rate-limiting or dropping malformed NAS registration messages at any signaling gateway/IPsec (N2) termination point if your deployment supports it, accepting that deep NAS inspection may add latency, and monitor the AMF process for crash-loops with automatic restart/supervision to shorten outage windows as a stopgap rather than a fix.