Which versions of Open5GS are affected by EUVD-2026-80936?

Open5GS versions up to and including 2.8.0 are affected by a high-severity denial-of-service vulnerability in the PFCP implementation that can crash the SMF/UPF processes and disrupt 5G user-plane…. A patch is available.

How to fix or mitigate EUVD-2026-80936?

Within 24 hours, inventory all Open5GS deployments to identify any running version 2.8.0 or earlier. Within 7 days, apply the upstream fix (commit 8f07b507b78ff94776f2cd49276eb116ed93d7f2) or upgrade to a release that incorporates it (patch available per vendor advisory); as an interim mitigation, restrict N4/PFCP traffic to authorized internal SMF/UPF peers only and enforce authentication if supported. Within 30 days, verify that all instances are patched, review network segmentation to confirm N4 is not internet-facing, and implement monitoring for process aborts or malformed PFCP messages. Note: vendor CVSS vector indicates PR:L (authenticated) while independent assessment scores it PR:N (unauthenticated), so treat the N4 interface as untrusted and apply defense-in-depth.

Open5GS EUVD-2026-80936

Q: What is the CVSS score of EUVD-2026-80936?

EUVD-2026-80936 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X.

| CVE-2026-92417 HIGH

NULL Pointer Dereference (CWE-476)

2026-09-16 VulDB

GHSA-3rv2-7gw6-fqvv

Denial Of Service Null Pointer Dereference Open5gs N A

7.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

PFCP/N4 has no application authentication (PR:N); malformed IE crashes the daemon with availability-only impact (A:H, C:N/I:N); network-reachable but realistically internal interface.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Sep 16, 2026 - 19:05 vuln.today

CVE Published

Sep 16, 2026 - 18:00 cve.org

HIGH 7.1

DescriptionCVE.org

A vulnerability was found in Open5GS up to 2.8.0. This affects the function ogs_pfcp_parse_volume_measurement in the library lib/pfcp/types.c of the component PFCP Handler. The manipulation results in null pointer dereference. The attack may be launched remotely. The patch is identified as 8f07b507b78ff94776f2cd49276eb116ed93d7f2. A patch should be applied to remediate this issue.

AnalysisAI

Denial of service in Open5GS up to and including 2.8.0: a crafted PFCP message that declares a Volume Measurement information element shorter than the fields the parser actually reads causes a null pointer dereference in ogs_pfcp_parse_volume_measurement in lib/pfcp/types.c, aborting the affected SMF/UPF process and disrupting the 5G core user-plane control path. The attack is launched remotely by sending malformed PFCP signaling to the N4 interface, which in a correctly segmented deployment is an internal control-plane segment rather than an internet-facing service; the vendor's CVSS 4.0 vector scores it 7.1 with PR:L, while our independent assessment scores 7.5 (CVSS 3.1, AV:N/AC:L/PR:N/UI:N, availability-only impact) because Open5GS's PFCP implementation does not enforce authentication. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Requires network reachability to the Open5GS PFCP/N4 interface (SMF/UPF control-plane), which in correct deployments is an internal, segmented network segment rather than an internet-facing service - this is the primary limiting factor. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	All signals point to a denial-of-service issue of moderate real-world urgency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Upstream fix available (PR/commit); released patched version not independently confirmed. … Detailed patch versions, workarounds, and compensating controls in full report.