Open5gs
Monthly
Denial of service in Open5GS up to and including 2.8.0: a crafted PFCP message that declares a Volume Measurement information element shorter than the fields the parser actually reads causes a null pointer dereference in ogs_pfcp_parse_volume_measurement in lib/pfcp/types.c, aborting the affected SMF/UPF process and disrupting the 5G core user-plane control path. The attack is launched remotely by sending malformed PFCP signaling to the N4 interface, which in a correctly segmented deployment is an internal control-plane segment rather than an internet-facing service; the vendor's CVSS 4.0 vector scores it 7.1 with PR:L, while our independent assessment scores 7.5 (CVSS 3.1, AV:N/AC:L/PR:N/UI:N, availability-only impact) because Open5GS's PFCP implementation does not enforce authentication. An upstream fix commit (8f07b507b78ff94776f2cd49276eb116ed93d7f2) is published, and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Remote unauthenticated denial-of-service against Open5GS v2.7.7 is possible by sending a crafted HTTP/2 SBI request containing an overlong timestamp string to the Session Management Function. The `ogs_sbi_time_from_string()` function in `lib/sbi/conv.c` copies characters into a fixed-size buffer using loop counters `j` and `k` without checking bounds, triggering a buffer overflow that crashes the SMF process and disrupts all active and new PDU sessions. Public proof-of-concept exploit code is available via the hackeryounow/5GCVulDB repository; no active exploitation is confirmed in CISA KEV.
Denial of service in Open5GS (open-source 5G/EPC core) through version 2.7.7 lets remote unauthenticated attackers crash the AMF by sending a malformed NAS 5GS mobile-identity information element, triggering a heap out-of-bounds read before authentication completes. Because the AMF handles mobility management for the entire network, a single crafted pre-authentication message can produce a subscriber-wide outage rather than affecting only the sender. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV, but the pre-auth network-reachable nature makes it a high-priority availability issue for anyone running Open5GS in production.
Denial of service in Open5GS up to and including 2.7.7: an unanswerable or failing PFCP Session Report path triggered from the GTP-U receive code causes the UPF (and the parallel SGW-U path) to abort or to leak PFCP transaction objects, degrading or halting user-plane service. The flaw is CWE-770 uncontrolled resource allocation in the GTP-U receive path (src/upf/gtp-path.c, ogs_pfcp_xact_local_create) and is remotely reachable without authentication or user interaction (CVSS:3.1 AV:N/AC:L/PR:N/UI:N), though in a correctly segmented 5G core the N3/GTP-U socket is exposed only to the access network (gNB) rather than the public internet. Impact is availability-only (CVSS 5.5, A:L, no confidentiality or integrity effect); publicly available exploit code exists, and no confirmed actively exploited (CISA KEV) status has been reported.
Malformed PFCP Session Report Request messages can abort the Open5GS SMF daemon, taking down all sessions handled by that SMF instance: in Open5GS through 2.8.0 the handler smf_n4_handle_session_report_request() signalled failure with a PFCP cause value that the caller in gsm-sm.c conflated with a session-release trigger, so a report with missing or inconsistent IEs drives execution into a reachable assertion (CWE-617) and terminates the process. The flaw is remotely triggerable by any host that can reach the SMF's N4/PFCP interface - normally the internal control-plane segment shared with the UPF - and because PFCP has no built-in authentication, no credentials are required once network reachability exists; the practical limiting factor is that N4 is not an internet-facing interface, not authentication. The authoritative assessment rates this AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (High availability impact only, no confidentiality or integrity impact), and no public exploit code has been identified at time of analysis, though an upstream fix commit is available.
Denial of service in Open5GS 2.7.7 and earlier lets a remote attacker crash the SGW-U/UPF process by sending a crafted PFCP Session Establishment or Modification Request containing a malformed Outer Header Creation IE. The handler fails to validate the Outer Header Creation description bits and payload length, so a failed GTP-U peer connection leaves a node with an unset address family in the peer list; a subsequent request referencing the same address reaches ogs_pfcp_far_f_teid_hash_set and aborts the process. Publicly available exploit code exists (GitHub issue #4699) and an upstream fix commit has been published, but the flaw is not listed in CISA KEV.
Use-after-free in Open5GS AMF component versions 2.0.x through 2.7.x allows network-reachable attackers to corrupt memory in the Access and Mobility Management Function process by triggering the old AMF discovery fallback handler with a crafted interaction. The root cause is premature deallocation of the SBI transaction structure (`ogs_sbi_xact_remove`) before the `discovery_option` argument derived from that structure is fully consumed; the fix relocates the free call past all dependent uses. No public exploit code has been identified; an upstream patch commit is available.
Improper authorization in Open5GS 2.7.7 and 2.8.0 AMF (5G) and MME (4G) components allows an authenticated, network-registered gNB or eNB to send crafted NG-Reset or S1-Reset messages listing NGAP/S1AP UE IDs that belong to sessions managed by a different base station. The AMF/MME processes these resets without verifying ownership, enabling session termination for subscribers served by other base stations. A publicly available proof-of-concept exists (GitHub issue #4680), and an upstream patch commit is available, though no versioned release has been independently confirmed.
Reachable assertion (CWE-617) in Open5GS through 2.7.7 allows remote authenticated attackers to abort the SMF (Session Management Function) process by supplying an invalid ARP preemption capability or vulnerability enum value via the Nudm SDM interface, disrupting all active PDU sessions managed by that instance. The root cause is the use of ogs_assert() for enum validation in smf_nudm_sdm_handle_get() - when preemptCap or preemptVuln holds an unexpected value, the assertion fires unconditionally and kills the process. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; vendor-confirmed fix is available in version 2.8.0.
Denial of service in Open5GS AMF (Access and Mobility Management Function) versions up to 2.7.7 allows a remote low-privileged attacker to crash the AMF process by submitting a crafted N1N2MessageTransfer request containing an unrecognized ngapIeType value, triggering an unchecked assertion termination. The AMF is a singleton or small-cluster critical component of 5G core infrastructure; its crash disconnects all user equipment registered through that instance until service restarts. A public exploit exists (GitHub issue #4396) and the fix is available in version 2.8.0, making patching the clear immediate action.
Remote denial-of-service in Open5GS HSS up to version 2.8.0 allows a low-privilege Diameter Cx peer to crash the Home Subscriber Server process by sending a UAR, MAR, SAR, or LIR request containing an empty User-Name or Public-Identity AVP, triggering a reachable assertion (CWE-617) in src/hss/hss-cx-path.c. A proof-of-concept is publicly available via GitHub issue #4675, and the upstream fix exists as commit c9abe09421eb99bbf1cd7862a3d375e58a4eb9e4; no formally tagged patched release version has been independently confirmed. No CISA KEV listing is present, constraining the assessed threat primarily to actors with internal Diameter network access.
Improper authorization in Open5GS 2.8.0's AMF UEContextReleaseRequest path handler allows remote low-privileged attackers to trigger unauthorized UE context release operations in the 5G core network. The flaw, tagged as an authentication bypass (CWE-285), affects the Access and Mobility Management Function - a security-critical component governing device connectivity and session management in 5G deployments. A proof-of-concept exploit exists (E:P in CVSS 4.0 supplemental), and no CISA KEV listing was identified at time of analysis.
Out-of-bounds read in Open5GS 2.8.0 PCRF Rx AA-Request handler allows remote low-privileged attackers with Diameter Rx interface access to send crafted AA-Request messages containing null or incorrectly-sized Framed-IP-Address or Framed-IPv6-Prefix AVPs, triggering memory reads beyond allocated boundaries. The patch commit c18dc6938bf63cc7374315d3dca303d92066e746 adds missing null and length validation for both AVP types; a tagged release incorporating it has not been independently confirmed. No active exploitation is recorded in CISA KEV, though the CVSS 4.0 E:P flag indicates proof-of-concept code is known to exist.
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer access to crash the Session Management Function (SMF) by sending a malformed Credit-Control-Answer (CCA) message to the smf_gx_cca_cb handler. A publicly available proof-of-concept crash sample (SMF.crashes.zip) confirms exploitability; the absence of a CISA KEV listing indicates no confirmed widespread threat-actor exploitation has been reported. In 5G/4G core network deployments, an SMF crash disrupts session management for all connected user equipment, making this a higher operational risk than the CVSS medium score alone suggests.
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipulating the Session-Id argument processed by the fd_msg_sess_get function, causing the HSS service to fail. Low-privileged network access to the Diameter interface is sufficient to exploit this flaw, and a proof-of-concept packet capture (HSS_ULR_error_poc.pcapng.zip) has been publicly released via GitHub. No active exploitation has been confirmed in CISA KEV, but the public POC materially lowers the barrier for targeted attacks against private LTE/5G deployments running this stack.
Memory corruption in Open5GS versions through 2.7.1 is remotely exploitable via the freeDiameter protocol component, allowing low-privileged network-accessible attackers to corrupt memory with limited confidentiality, integrity, and availability impact. The vulnerability falls under CWE-119 and is tagged as a buffer overflow class flaw within the Diameter protocol handling stack used in 5G/4G core network deployments. No public exploit has been identified at time of analysis, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog; however, the telecom-grade attack surface warrants attention for operators running Open5GS in production.
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER handler, causing a denial of service. The vulnerability exists in diam_log_func within lib/diameter/common/init.c, where a call to ogs_assert_if_reached() could be triggered by a crafted Capabilities Exchange Request message over the Diameter protocol. A public exploit exists and a patched release (v2.7.7) is available; no active exploitation has been confirmed via CISA KEV.
Denial of service in the Open5GS AMF component (versions up to 2.7.7) can be triggered remotely by a low-privileged attacker via improper resource handling in the `amf_nnrf_handle_nf_discover` function of `src/amf/nnrf-handler.c`. The AMF is a critical 5G core control-plane element; crashing or hanging it disrupts mobility management and NF discovery for all connected UEs and network functions. A public proof-of-concept exists (GitHub issue #4517), and a patch commit has been identified, though the fix originates in a fork rather than the mainline repository.
Race condition in Open5GS AMF up to version 2.7.6 allows a remote, low-privileged attacker to trigger concurrent NGAP Security Mode Command processing in gmm_state_security_mode (src/amf/gmm-sm.c), resulting in low availability impact. Publicly available exploit code exists (N2-SMC-Concurrent.zip), though no public exploit identified at time of analysis indicates active exploitation and this CVE is not listed in CISA KEV. Notably, the associated fix PR (#4501) addresses a broader NGAP identity-scoping flaw - where the AMF accepted UE-associated NGAP messages from any gNB regardless of which gNB originally registered the UE - suggesting the underlying attack surface may exceed what the formal CVSS score of 3.1 captures.
Authentication bypass in Open5GS versions up to 2.7.6 allows remote attackers to manipulate UE security capabilities through the AMF's NGAP PathSwitchRequest message handler in src/amf/ngap-handler.c. The flaw stems from the AMF blindly overwriting locally stored UE 5G security capabilities with values received from a target gNB during a path switch, violating 3GPP TS 33.501 6.7.3.1, and publicly available exploit code exists though no public exploit identified as actively exploited at time of analysis.
Denial of service in Open5GS up to version 2.7.7 is triggerable by a low-privileged remote attacker via the `ogs_pool_id_calloc` function in the SBI nghttp2-server library, causing availability degradation of 5G core network functions. The CVSS temporal modifiers confirm both a public proof-of-concept (E:P) and an official remedy (RL:O). No public exploit identified at time of analysis as confirmed by CISA KEV, but the publicly available PoC on GitHub (issue #4474) materially lowers the exploitation barrier for actors with access to SBI endpoints.
Timer pool exhaustion in Open5GS up to 2.7.7 allows an authenticated remote attacker with low privileges to crash the UE authentication service via rapid HTTP/2 stream resets against the ue-authentications SBI endpoint. The root cause is CWE-404: response timers for outbound SBI transactions are not released when the originating inbound HTTP/2 stream closes prematurely (via RST_STREAM or connection drop), causing the timer pool to exhaust when a peer resets streams rapidly while upstream network functions are slow or unresponsive. No public exploit identified at time of analysis as KEV status, but a publicly available exploit code exists via GitHub issue #4473, and an upstream fix is available in PR #4578.
Denial-of-service via reachable assertion in Open5GS NRF (Network Repository Function) up to version 2.7.7 allows an authenticated low-privilege network peer to crash the NRF process with SIGABRT by submitting a crafted NFProfile registration payload with oversized inner-list arrays in SMF or AMF info sections. The NRF is a critical singleton service registry in 5G Service-Based Architecture - crashing it disrupts NF discovery for the entire 5G core, making the practical operational impact greater than the A:L CVSS impact rating alone suggests. Publicly available exploit code exists (GitHub issue #4469 and CVSS temporal E:P), though no confirmed active exploitation via CISA KEV has been recorded at time of analysis.
Out-of-bounds write in Open5GS versions up to 2.7.7 allows a remote, low-privileged attacker to crash the NRF (Network Repository Function) component by sending a malformed SCP info payload, resulting in a denial-of-service condition. The vulnerability resides in the handle_scp_info function within the Shared NF-profile Parser (lib/sbi/nnrf-handler.c), a critical parsing path for 5G service-based interface communication. A public proof-of-concept exploit has been disclosed via the project's GitHub issue tracker, materially lowering the bar for exploitation against unpatched deployments.
Denial of service in Open5GS NRF (Network Repository Function) through version 2.7.7 allows an authenticated network peer to crash the NRF process with SIGABRT by submitting a crafted SMF or AMF NF-profile registration containing oversized inner-loop arrays. The NRF's shared NF-profile parser in lib/sbi/nnrf-handler.c used reachable ogs_assert() calls - rather than graceful bounds checks - to enforce limits on DNN entries per S-NSSAI slice and TAC range entries per TAI range, making them triggerable by peer-supplied payloads. Publicly available exploit code exists (GitHub issue #4467); the CVSSv4 score of 2.1 reflects scoped low-availability impact but understates operational risk given the NRF's central role in 5G core service discovery.
Use-after-free vulnerability in Open5GS NRF component (versions up to 2.7.7) allows authenticated remote attackers to trigger denial of service via the discover_handler function in nghttp2-server.c. Publicly available exploit code exists (GitHub issue #4476), but vendor has not responded to early disclosure. EPSS data not available; CVSS 4.3 (Medium) reflects limited scope (DoS only, authenticated access required). Not listed in CISA KEV, indicating no confirmed widespread exploitation despite public POC.
Remote authenticated denial of service in Open5GS versions up to 2.7.7 allows attackers to crash the AUSF (Authentication Server Function) component via crafted timer manipulation. The vulnerability resides in ogs_timer_add function within nausf-handler.c. Public exploit code exists via GitHub issue #4472, though vendor has not responded to disclosure. EPSS data unavailable; CVSS 4.0 scores only 2.1 due to low availability impact and authenticated requirement, but the existence of public exploit elevates practical risk for exposed 5G core deployments.
Denial of service in Open5GS NRF (Network Repository Function) allows authenticated remote attackers to crash the service by exhausting the nf_service resource pool. Open5GS versions up to 2.7.7 fail to validate pool allocation during NF service registration, triggering assertion failures that terminate the process. Publicly available exploit code exists (GitHub issue #4466). EPSS data not available, not listed in CISA KEV. Patch released via commit 819db11a08b9736a3576c4f99ceb28f7eb99523a, merged in PR #4534.
Improper authorization in Open5GS AMF/MME component (versions up to 2.7.6) allows authenticated network attackers to manipulate NGAP user context lookups, potentially accessing or interfering with other users' 5G/LTE sessions. The vulnerability stems from insufficient validation of AMF_UE_NGAP_ID and RAN_UE_NGAP_ID pairs in the ran_ue_find_by_amf_ue_ngap_id function, enabling attackers with low-level network privileges to bypass session-to-base-station association controls. Publicly available exploit code exists (GitHub issue #4498), and a vendor-released patch (commit 5746b857) is available. CVSS 6.3 (Medium) reflects network vector with low attack complexity but requires authentication.
Denial of service vulnerability in Open5GS NRF client management (versions ≤2.7.7) allows authenticated remote attackers to crash the Network Repository Function service via malformed client pool arguments. Public exploit code exists (GitHub issue #4464), but vendor has not responded to disclosure. CVSS base score of 4.3 reflects low severity due to limited availability impact and authentication requirement. EPSS data not provided; KEV status not applicable for this unpatched issue.
Denial of service in Open5GS versions up to 2.7.6 allows authenticated remote attackers to crash the Network Repository Function (NRF) component via crafted nfInstanceId parameter manipulation in the ogs_sbi_nf_instance_set_id function. Publicly available exploit code exists (GitHub issue #4462), but vendor has not responded to early responsible disclosure. EPSS data not available, not listed in CISA KEV. CVSS 4.3 (Medium) reflects low impact (availability only) and authenticated attack vector.
Denial of service in Open5GS versions up to 2.7.7 allows authenticated remote attackers to crash the Network Repository Function (NRF) component by manipulating service-names or snssais parameters in SBI messages. A public proof-of-concept exploit exists via GitHub issue #4460, and the vendor has not responded to the early disclosure. EPSS data unavailable, but the low CVSS 4.3 score reflects limited impact (availability only, authenticated access required), reducing real-world urgency for most deployments.
Denial of service in Open5GS versions up to 2.7.7 allows authenticated remote attackers to crash the Network Repository Function (NRF) component via malformed target-plmn-list parameters. The vulnerability targets a parsing function in the Service-Based Interface (SBI) library and has publicly available exploit code (GitHub issue #4458). CVSS 4.3 reflects low severity, but the vendor has not responded to early disclosure attempts, leaving no confirmed patch timeline. EPSS and KEV data unavailable - exploitation likelihood beyond POC unknown.
Denial of service in Open5GS up to version 2.7.7 allows authenticated remote attackers to crash the NRF component by manipulating the hnrf-uri argument passed to the yuarel_parse function in /lib/sbi/conv.c. The vulnerability has a publicly available exploit and low CVSS score (4.3) due to authentication requirement and limited scope, but affects a critical 5G network function with potential operational impact.
Denial of service in Open5GS NRF component up to version 2.7.7 allows remote authenticated attackers to exhaust the nf_service memory pool via the ogs_nnrf_nfm_handle_nf_profile function, causing the process to abort via failed assertion. Publicly available exploit code exists, and a vendor patch is available but awaits acceptance into the main branch.
Denial of service in Open5GS through version 2.7.7 allows authenticated remote attackers to crash the Service Management Function (SMF) by manipulating the smf_nsmf_handle_update_data_in_vsmf function in nsmf-handler.c. Publicly available exploit code exists, and the project maintainers have not yet responded to the early disclosure notification despite awareness of the issue.
Denial of service in Open5GS up to version 2.7.7 allows authenticated remote attackers to crash the Session Management Function (SMF) by manipulating the qosFlowProfile argument in the smf_nsmf_handle_update_data_in_vsmf function. Publicly available exploit code exists, and the vulnerability affects the 5G core network's ability to manage quality-of-service parameters, though the project maintainers have not yet responded to early disclosure.
Denial of service in Open5GS SMF (Session Management Function) via crafted PDU Session Modification messages allows remote authenticated attackers to trigger unvalidated parameter processing in gsm_handle_pdu_session_modification_qos_flow_descriptions(), causing service disruption. The vulnerability stems from insufficient pre-validation of QoS flow parameter identifiers and bitrate units before state mutation, potentially leaving the SMF in an inconsistent state. Publicly available exploit code exists, and a fix awaits upstream acceptance in PR #4513.
Denial of service in Open5GS up to version 2.7.7 allows authenticated remote attackers to crash the Session Management Function (SMF) via manipulation of QoS rule parsing in the ogs_nas_parse_qos_rules function. The vulnerability has a low CVSS score of 2.1 but public exploit code is available; however, exploitation requires prior authentication and causes only availability impact without confidentiality or integrity compromise.
Denial of service vulnerability in Open5GS up to version 2.7.7 affects the SMF (Session Management Function) component's smf_nsmf_handle_create_sm_context function, allowing authenticated remote attackers to crash or degrade the 5G core network service through malformed session context creation requests. Public exploit code exists and the vulnerability has low real-world severity (CVSS 2.1) due to requirement for authenticated access and availability impact only, though active 5G infrastructure targeting remains a concern given the critical nature of SMF in telecom deployments.
Denial of service in Open5GS up to version 2.7.7 affects the SMF component's OpenAPI_list_create function, allowing authenticated remote attackers to cause service unavailability through resource manipulation. The vulnerability has low to moderate severity (CVSS 4.3) with publicly disclosed proof-of-concept code, though the vendor has not yet responded to early disclosure notification.
Remote authenticated denial of service in Open5GS up to version 2.7.7 affects the SMF (Session Management Function) component, specifically in the smf_nsmf_handle_created_data_in_vsmf function. An authenticated attacker can remotely trigger a denial of service condition by sending crafted requests. Public exploit code is available (CVE-2026-8267 GitHub issue #4448), though the vendor has not yet released a patched version despite early notification.
Denial of service in Open5GS up to version 2.7.7 allows authenticated remote attackers to crash the Service Management Function (SMF) via manipulation of the PDU session establishment acceptance function, resulting in service unavailability. The CVSS score of 4.3 reflects low severity due to authentication requirements and availability-only impact, though publicly available exploit code exists and the vulnerability has been reported to the project without acknowledged response.
Null pointer dereference in Open5GS Session Management Function (SMF) up to version 2.7.7 allows authenticated remote attackers to cause denial of service by manipulating the smf_nsmf_handle_create_data_in_hsmf function. Publicly available exploit code exists, and the project has been notified but has not yet released a patch.
Denial of service in Open5GS up to version 2.7.7 allows authenticated remote attackers to crash the Service Mobile Function (SMF) component via manipulation of the update_authorized_pcc_rule_and_qos function in the Policy and Charging Control (PCC) handler. The vulnerability has a CVSS score of 2.1 with low availability impact; publicly available exploit code exists, and the project maintainers have not yet responded to early disclosure.
Denial of service in Open5GS up to version 2.7.7 via the smf_n4_build_qos_flow_to_modify_list function in the SMF (Session Management Function) component allows remote authenticated attackers to crash the service with low attack complexity. The vulnerability has been publicly disclosed with exploit code available; the vendor was notified early but has not yet released a fix.
Denial of service vulnerability in Open5GS up to version 2.7.7 allows authenticated remote attackers to crash the Service Measurement Function (SMF) component via improper handling in the update_authorized_pcc_rule_and_qos function. The vulnerability has a publicly available exploit and moderate CVSS score (4.3) but is limited to authenticated access and results in availability impact only. The vendor has not yet released a patch despite early notification through a GitHub issue.
Denial of service in Open5GS up to version 2.7.7 allows authenticated remote attackers to crash the Service Mobility Function (SMF) component via manipulation of the update_authorized_pcc_rule_and_qos function in npcf-handler.c. Publicly available exploit code exists, and the vendor has not released a patch despite early notification through issue tracking.
Denial of service vulnerability in Open5GS up to version 2.7.7 allows remote unauthenticated attackers to crash the service by triggering improper exception handling in the ogs_pcc_rule_install_flow_from_media function within the PCC rule processing library. Publicly available exploit code exists, and the project maintainers have not responded to the early notification despite issue tracking.
Denial of service in Open5GS up to version 2.7.7 allows remote unauthenticated attackers to crash the Policy Control Function (PCF) by manipulating the SmPolicyContextData.ipv6AddressPrefix parameter in the pcf_sess_set_ipv6prefix function. The vulnerability has publicly available exploit code and was disclosed despite vendor non-responsiveness, making it a known attack vector against 5G service provider infrastructure.
Denial of service in Open5GS up to version 2.7.7 via manipulation of the pcf_sess_sbi_discover_and_send function in the sm-policies endpoint allows remote unauthenticated attackers to disrupt service availability. Publicly available exploit code exists, and the upstream project has not yet issued a patch despite early notification via issue report.
Remote denial of service in Open5GS up to version 2.7.7 affects the sm-policies endpoint's pcf_nbsf_management_handle_register function, allowing unauthenticated network attackers to trigger a crash or service disruption with low attack complexity. Publicly available exploit code exists and the vendor was notified early but has not released a fix.
Denial of service in Open5GS up to version 2.7.7 allows remote unauthenticated attackers to crash the Policy Control Function (PCF) service by sending crafted requests to the delete endpoint in the SM policy control handler (pcf_npcf_smpolicycontrol_handle_delete). The vulnerability has a publicly available proof of concept and impacts the availability of 5G network policy enforcement, though the vendor has not yet released a patch despite early notification.
Out-of-bounds read in Open5GS up to version 2.7.7 allows remote attackers to trigger information disclosure via manipulation of the ogs_sbi_client_send_via_scp_or_sepp function in lib/sbi/client.c during Service-Based Interface (SBI) communication. The vulnerability exploits improper bounds checking when extracting paths from URIs, affecting the Network Function (NF) component. CVSS 6.9 (network-accessible, low complexity, no privileges required) with availability impact. Upstream patch commit d5bc487fcf9ea87d2b03f2ef95123af344773bfb available.
Denial of service in Open5GS User Plane Function (UPF) up to version 2.7.7 allows remote, unauthenticated attackers to exhaust server resources through manipulation of GTPv1-U packet handling in the _gtpv1_u_recv_cb function. The vulnerability enables resource consumption attacks against 5G core network infrastructure without requiring authentication or user interaction. Vendor notification occurred via GitHub issue #4492 but has not received developer response or a released patch.
Denial of service in Open5GS up to version 2.7.7 affects the NSSF component's ogs_sbi_discovery_option_add_snssais function, allowing authenticated remote attackers to crash the service via a network request. The vulnerability has been publicly disclosed with exploit code available on GitHub, though the vendor has not yet responded to early notification.
Denial of service vulnerability in Open5GS up to version 2.7.7 affects the NSSF component's service discovery function, allowing remote authenticated attackers to cause availability impact through manipulation of the ogs_sbi_discovery_option_add_service_names function. Public exploit code exists and the vulnerability carries low CVSS score (2.1) reflecting limited impact scope, though the project has not yet responded to early notification.
Denial of service in Open5GS up to version 2.7.7 allows authenticated remote attackers to crash the NSSF (Network Slice Selection Function) component via a crafted PLMN list in the SBI (Service Based Interface) parser. The vulnerability exists in the ogs_sbi_parse_plmn_list function within /lib/sbi/conv.c and has been publicly disclosed with exploit code available; the vendor has not yet released a patch despite early notification.
Denial of service in Open5GS up to version 2.7.7 allows authenticated remote attackers to manipulate the NSSF network selection function via the nssf_nnrf_nsselection_handle_get_from_amf_or_vnssf handler in /src/nssf/nnssf-handler.c, causing service unavailability. Public exploit code exists and the vulnerability has been reported to the project, though no patch has been released as of analysis time.
Denial of service in Open5GS up to version 2.7.7 affects the NSSF component's stream identification function in the nghttp2-server library. Local authenticated attackers can manipulate the ogs_sbi_stream_find_by_id function to cause service unavailability. Publicly available exploit code exists, though the vendor has not yet responded to early disclosure notification.
Denial of service in Open5GS up to version 2.7.7 affects the AMF 3GPP access endpoint handler (udm_nudm_uecm_handle_amf_registration_update function), allowing authenticated remote attackers to crash the UDM service via malformed registration update messages. Publicly available exploit code exists, and the vendor was notified early but has not released a patch as of the analysis date.
Denial of service in Open5GS up to version 2.7.7 affects the udm_state_operational function in the smf-registrations endpoint, allowing authenticated remote attackers to manipulate the function and cause service unavailability. The vulnerability has publicly available exploit code and carries a low CVSS score of 2.1 due to required authentication and limited availability impact, though the project has not yet responded to early disclosure.
Denial of service in Open5GS up to version 2.7.7 affects the authentication-subscription endpoint handler, allowing authenticated remote attackers to manipulate the udm_nudr_dr_handle_subscription_authentication function and cause service unavailability. Public exploit code exists and the vulnerability has been reported to the project without a confirmed vendor response or patch release.
Denial of service in Open5GS UDR component up to version 2.7.7 allows authenticated remote attackers to crash the subscription data service by manipulating the supi_id argument to the ogs_dbi_subscription_data function. Publicly available exploit code exists, and the vendor has been notified via issue report but has not yet released a patch.
Denial of service in Open5GS UDR component (versions up to 2.7.7) via malformed pei argument in udr_nudr_dr_handle_subscription_context function allows authenticated remote attackers to crash the User Data Repository service with low complexity. Publicly available exploit code exists; vendor has not responded to early notification.
Denial of service in Open5GS versions up to 2.7.7 allows authenticated remote attackers to crash the AMF (Access and Mobility Management Function) component by exploiting improper error handling in the gmm_handle_service_request function. The vulnerability requires low-privilege authentication to trigger and results in service unavailability. A public exploit has been disclosed via GitHub issue tracker, though the vendor has not yet released a patch despite early notification.
Denial of service in Open5GS AMF (Access and Mobility Function) up to version 2.7.6 allows authenticated remote attackers to cause service unavailability by sending crafted registration requests with manipulated reg_type arguments. The vulnerability exists in the GMM (Mobility Management) handler due to insufficient validation of registration type values, potentially triggering null pointer dereferences or assertion failures. Vendor-released patch version 2.7.7 is available.
Denial of service in Open5GS AMF component up to version 2.7.7 allows authenticated remote attackers to trigger resource exhaustion via improper handling of PDU session context update messages in the amf_nsmf_pdusession_handle_update_sm_context function. The vulnerability has a low CVSS score (2.1) but publicly available exploit code exists; however, exploitation requires prior authentication to the 5G network, significantly limiting real-world attack surface.
Denial of service in Open5GS up to version 2.7.7 affects the AMF (Access and Mobility Function) component, specifically the ogs_id_get_value function in nudm-handler.c, allowing remote authenticated attackers to cause service unavailability. Publicly available exploit code exists, and the vulnerability has been reported to the project via GitHub issue #4405 without vendor acknowledgment or patch release at time of analysis.
Denial of service in Open5GS up to version 2.7.7 allows authenticated remote attackers to crash the AMF (Access and Mobility Management Function) component via manipulation of the amf_nudm_sdm_handle_provisioned function in the NUDM handler. The vulnerability has publicly available exploit code and affects the authentication and mobility management core of 5G networks, requiring valid credentials to trigger but resulting in service unavailability. Public disclosure has occurred without vendor remediation at the time of analysis.
Denial of service in Open5GS up to version 2.7.7 allows authenticated remote attackers to crash the BSF (Binding Support Function) component by manipulating the ipv6Prefix argument in the bsf_sess_find_by_ipv6prefix function. The vulnerability has a low CVSS score of 2.1 due to requiring authentication and causing only availability impact, but publicly available exploit code exists and the vendor has not yet responded to early disclosure.
Denial of service in Open5GS up to version 2.7.7 allows remote unauthenticated attackers to crash the BSF (Binding Support Function) service by manipulating the ipv4Addr parameter in the /nbsf-management/v1/pcfBindings endpoint. The vulnerability has publicly available exploit code and affects a core 5G network function, creating operational risk for mobile networks relying on this open-source implementation.
Denial of service in Open5GS 2.7.6 via malformed CCA (Credit-Control-Answer) messages in the SMF (Session Management Function) component allows remote attackers to crash the service without authentication. The vulnerability affects the smf_gx_cca_cb, smf_gy_cca_cb, and smf_s6b functions in the CCA Message Handler, with publicly available exploit code demonstrating the attack despite high complexity requirements. CVSS 6.3 reflects the availability impact and remote attack vector, though exploitation requires crafted network conditions.
Denial of service in Open5GS through version 2.7.6 affects the CCA Handler component's callback functions, allowing unauthenticated remote attackers to crash the service. Public exploit code is available for this vulnerability. Upgrading to version 2.7.7 resolves the issue.
Open5GS 2.7.6 is vulnerable to denial of service through improper handling of S11 session response messages in the MME component, allowing remote unauthenticated attackers to crash the service. Public exploit code exists for this vulnerability, and the vendor has not yet provided a patch despite early notification.
Open5GS versions up to 2.7.6 are vulnerable to a denial of service condition in the SMF component's PDP context request handler, which can be triggered remotely without authentication. An attacker can exploit this reachable assertion flaw to crash the service, and public exploit code is currently available. No patch has been released by the project despite early notification of the issue.
Memory corruption in Open5GS up to version 2.7.6 allows remote attackers to cause denial of service through manipulation of the MME component's esm-build.c file. Public exploit code exists for this vulnerability, and the Open5GS project has not yet released a patch despite early notification.
Memory corruption in Open5GS versions up to 2.7.6 allows remote attackers to trigger a denial of service condition by manipulating the SGW-C session creation handler, with public exploit code already available. The vulnerability requires no authentication or user interaction and currently lacks a vendor patch, leaving affected deployments vulnerable to remote availability attacks.
Open5GS versions up to 2.7.6 are vulnerable to a denial of service attack in the SMF component's TFT parsing function when a crafted packet manipulates the traffic filter content length parameter. An unauthenticated remote attacker can trigger this flaw to crash the service, and public exploit code exists with no patch currently available.
Open5GS versions up to 2.7.6 suffer from a null pointer dereference in the PGW S5U Address Handler component that can be triggered remotely without authentication, resulting in denial of service. Public exploit code exists for this vulnerability, and administrators should apply the available patch immediately.
A security flaw has been discovered in Open5GS up to 2.7.6. Affected by this vulnerability is the function hss_ogs_diam_cx_mar_cb of the file src/hss/hss-cx-path.c of the component VoLTE Cx-Test. [CVSS 7.3 HIGH]
Remote denial of service in Open5GS up to version 2.7.6 allows unauthenticated attackers to trigger a reachable assertion in the SGWC component by manipulating PDR arguments in the sgwc_tunnel_add function. Public exploit code exists for this vulnerability, and no patch is currently available despite reports indicating a fix is planned.
Open5GS versions up to 2.7.6 contain a reachable assertion vulnerability in the CreateBearerRequest handler that allows unauthenticated remote attackers to trigger a denial of service condition. Public exploit code exists for this vulnerability, and no patch is currently available. The impact is limited to service availability, with a CVSS score of 5.3.
Open5GS versions up to 2.7.6 contain a reachable assertion vulnerability in the SGWC S11 handler that can be triggered remotely without authentication to cause a denial of service. Public exploit code exists for this vulnerability, and while a patch is reported as already-fixed, it remains unavailable for affected deployments.
Denial of service in Open5GS up to version 2.7.6 allows remote attackers to crash the SGWC service by manipulating the Modify Bearer Request handler in s11-handler.c. Public exploit code exists for this vulnerability and no patch is currently available. Organizations running affected versions should apply updates as they become available and consider network-level mitigations to restrict access to the S11 interface.
Remote denial of service in Open5GS up to version 2.7.5 affects the SGWC component's TEID-to-IP conversion function, allowing unauthenticated attackers to crash the service over the network. Public exploit code exists for this vulnerability, and while a fix has been developed, no official patch is currently available for affected deployments.
Remote denial of service in Open5GS up to version 2.7.6 affects the SGWC component's bearer response handler, allowing unauthenticated attackers to crash the service over the network. Public exploit code exists for this vulnerability, though a patch (commit b19cf6a) is available to resolve it.
Remote denial of service in Open5GS up to version 2.7.6 allows unauthenticated attackers to crash the SGWC component by manipulating bearer resource failure indication messages. Public exploit code exists for this vulnerability, and a patch is available in commit 69b53add90a9479d7960b822fc60601d659c328b.
Open5gs WebUI authentication can be bypassed by attackers who exploit the default hardcoded JWT signing key ("change-me") that is used when the JWT_SECRET_KEY environment variable is not configured. An attacker can forge valid JWT tokens to gain unauthorized access to the WebUI with limited confidentiality and integrity impacts. A patch is available to remediate this vulnerability by enforcing proper key configuration or using secure defaults.
A vulnerability was determined in Open5GS up to 2.7.6. Impacted is the function sgwc_s11_handle_downlink_data_notification_ack of the file src/sgwc/s11-handler.c of the component sgwc. [CVSS 5.3 MEDIUM]
Denial of service in Open5GS up to and including 2.8.0: a crafted PFCP message that declares a Volume Measurement information element shorter than the fields the parser actually reads causes a null pointer dereference in ogs_pfcp_parse_volume_measurement in lib/pfcp/types.c, aborting the affected SMF/UPF process and disrupting the 5G core user-plane control path. The attack is launched remotely by sending malformed PFCP signaling to the N4 interface, which in a correctly segmented deployment is an internal control-plane segment rather than an internet-facing service; the vendor's CVSS 4.0 vector scores it 7.1 with PR:L, while our independent assessment scores 7.5 (CVSS 3.1, AV:N/AC:L/PR:N/UI:N, availability-only impact) because Open5GS's PFCP implementation does not enforce authentication. An upstream fix commit (8f07b507b78ff94776f2cd49276eb116ed93d7f2) is published, and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Remote unauthenticated denial-of-service against Open5GS v2.7.7 is possible by sending a crafted HTTP/2 SBI request containing an overlong timestamp string to the Session Management Function. The `ogs_sbi_time_from_string()` function in `lib/sbi/conv.c` copies characters into a fixed-size buffer using loop counters `j` and `k` without checking bounds, triggering a buffer overflow that crashes the SMF process and disrupts all active and new PDU sessions. Public proof-of-concept exploit code is available via the hackeryounow/5GCVulDB repository; no active exploitation is confirmed in CISA KEV.
Denial of service in Open5GS (open-source 5G/EPC core) through version 2.7.7 lets remote unauthenticated attackers crash the AMF by sending a malformed NAS 5GS mobile-identity information element, triggering a heap out-of-bounds read before authentication completes. Because the AMF handles mobility management for the entire network, a single crafted pre-authentication message can produce a subscriber-wide outage rather than affecting only the sender. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV, but the pre-auth network-reachable nature makes it a high-priority availability issue for anyone running Open5GS in production.
Denial of service in Open5GS up to and including 2.7.7: an unanswerable or failing PFCP Session Report path triggered from the GTP-U receive code causes the UPF (and the parallel SGW-U path) to abort or to leak PFCP transaction objects, degrading or halting user-plane service. The flaw is CWE-770 uncontrolled resource allocation in the GTP-U receive path (src/upf/gtp-path.c, ogs_pfcp_xact_local_create) and is remotely reachable without authentication or user interaction (CVSS:3.1 AV:N/AC:L/PR:N/UI:N), though in a correctly segmented 5G core the N3/GTP-U socket is exposed only to the access network (gNB) rather than the public internet. Impact is availability-only (CVSS 5.5, A:L, no confidentiality or integrity effect); publicly available exploit code exists, and no confirmed actively exploited (CISA KEV) status has been reported.
Malformed PFCP Session Report Request messages can abort the Open5GS SMF daemon, taking down all sessions handled by that SMF instance: in Open5GS through 2.8.0 the handler smf_n4_handle_session_report_request() signalled failure with a PFCP cause value that the caller in gsm-sm.c conflated with a session-release trigger, so a report with missing or inconsistent IEs drives execution into a reachable assertion (CWE-617) and terminates the process. The flaw is remotely triggerable by any host that can reach the SMF's N4/PFCP interface - normally the internal control-plane segment shared with the UPF - and because PFCP has no built-in authentication, no credentials are required once network reachability exists; the practical limiting factor is that N4 is not an internet-facing interface, not authentication. The authoritative assessment rates this AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (High availability impact only, no confidentiality or integrity impact), and no public exploit code has been identified at time of analysis, though an upstream fix commit is available.
Denial of service in Open5GS 2.7.7 and earlier lets a remote attacker crash the SGW-U/UPF process by sending a crafted PFCP Session Establishment or Modification Request containing a malformed Outer Header Creation IE. The handler fails to validate the Outer Header Creation description bits and payload length, so a failed GTP-U peer connection leaves a node with an unset address family in the peer list; a subsequent request referencing the same address reaches ogs_pfcp_far_f_teid_hash_set and aborts the process. Publicly available exploit code exists (GitHub issue #4699) and an upstream fix commit has been published, but the flaw is not listed in CISA KEV.
Use-after-free in Open5GS AMF component versions 2.0.x through 2.7.x allows network-reachable attackers to corrupt memory in the Access and Mobility Management Function process by triggering the old AMF discovery fallback handler with a crafted interaction. The root cause is premature deallocation of the SBI transaction structure (`ogs_sbi_xact_remove`) before the `discovery_option` argument derived from that structure is fully consumed; the fix relocates the free call past all dependent uses. No public exploit code has been identified; an upstream patch commit is available.
Improper authorization in Open5GS 2.7.7 and 2.8.0 AMF (5G) and MME (4G) components allows an authenticated, network-registered gNB or eNB to send crafted NG-Reset or S1-Reset messages listing NGAP/S1AP UE IDs that belong to sessions managed by a different base station. The AMF/MME processes these resets without verifying ownership, enabling session termination for subscribers served by other base stations. A publicly available proof-of-concept exists (GitHub issue #4680), and an upstream patch commit is available, though no versioned release has been independently confirmed.
Reachable assertion (CWE-617) in Open5GS through 2.7.7 allows remote authenticated attackers to abort the SMF (Session Management Function) process by supplying an invalid ARP preemption capability or vulnerability enum value via the Nudm SDM interface, disrupting all active PDU sessions managed by that instance. The root cause is the use of ogs_assert() for enum validation in smf_nudm_sdm_handle_get() - when preemptCap or preemptVuln holds an unexpected value, the assertion fires unconditionally and kills the process. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; vendor-confirmed fix is available in version 2.8.0.
Denial of service in Open5GS AMF (Access and Mobility Management Function) versions up to 2.7.7 allows a remote low-privileged attacker to crash the AMF process by submitting a crafted N1N2MessageTransfer request containing an unrecognized ngapIeType value, triggering an unchecked assertion termination. The AMF is a singleton or small-cluster critical component of 5G core infrastructure; its crash disconnects all user equipment registered through that instance until service restarts. A public exploit exists (GitHub issue #4396) and the fix is available in version 2.8.0, making patching the clear immediate action.
Remote denial-of-service in Open5GS HSS up to version 2.8.0 allows a low-privilege Diameter Cx peer to crash the Home Subscriber Server process by sending a UAR, MAR, SAR, or LIR request containing an empty User-Name or Public-Identity AVP, triggering a reachable assertion (CWE-617) in src/hss/hss-cx-path.c. A proof-of-concept is publicly available via GitHub issue #4675, and the upstream fix exists as commit c9abe09421eb99bbf1cd7862a3d375e58a4eb9e4; no formally tagged patched release version has been independently confirmed. No CISA KEV listing is present, constraining the assessed threat primarily to actors with internal Diameter network access.
Improper authorization in Open5GS 2.8.0's AMF UEContextReleaseRequest path handler allows remote low-privileged attackers to trigger unauthorized UE context release operations in the 5G core network. The flaw, tagged as an authentication bypass (CWE-285), affects the Access and Mobility Management Function - a security-critical component governing device connectivity and session management in 5G deployments. A proof-of-concept exploit exists (E:P in CVSS 4.0 supplemental), and no CISA KEV listing was identified at time of analysis.
Out-of-bounds read in Open5GS 2.8.0 PCRF Rx AA-Request handler allows remote low-privileged attackers with Diameter Rx interface access to send crafted AA-Request messages containing null or incorrectly-sized Framed-IP-Address or Framed-IPv6-Prefix AVPs, triggering memory reads beyond allocated boundaries. The patch commit c18dc6938bf63cc7374315d3dca303d92066e746 adds missing null and length validation for both AVP types; a tagged release incorporating it has not been independently confirmed. No active exploitation is recorded in CISA KEV, though the CVSS 4.0 E:P flag indicates proof-of-concept code is known to exist.
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer access to crash the Session Management Function (SMF) by sending a malformed Credit-Control-Answer (CCA) message to the smf_gx_cca_cb handler. A publicly available proof-of-concept crash sample (SMF.crashes.zip) confirms exploitability; the absence of a CISA KEV listing indicates no confirmed widespread threat-actor exploitation has been reported. In 5G/4G core network deployments, an SMF crash disrupts session management for all connected user equipment, making this a higher operational risk than the CVSS medium score alone suggests.
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipulating the Session-Id argument processed by the fd_msg_sess_get function, causing the HSS service to fail. Low-privileged network access to the Diameter interface is sufficient to exploit this flaw, and a proof-of-concept packet capture (HSS_ULR_error_poc.pcapng.zip) has been publicly released via GitHub. No active exploitation has been confirmed in CISA KEV, but the public POC materially lowers the barrier for targeted attacks against private LTE/5G deployments running this stack.
Memory corruption in Open5GS versions through 2.7.1 is remotely exploitable via the freeDiameter protocol component, allowing low-privileged network-accessible attackers to corrupt memory with limited confidentiality, integrity, and availability impact. The vulnerability falls under CWE-119 and is tagged as a buffer overflow class flaw within the Diameter protocol handling stack used in 5G/4G core network deployments. No public exploit has been identified at time of analysis, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog; however, the telecom-grade attack surface warrants attention for operators running Open5GS in production.
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER handler, causing a denial of service. The vulnerability exists in diam_log_func within lib/diameter/common/init.c, where a call to ogs_assert_if_reached() could be triggered by a crafted Capabilities Exchange Request message over the Diameter protocol. A public exploit exists and a patched release (v2.7.7) is available; no active exploitation has been confirmed via CISA KEV.
Denial of service in the Open5GS AMF component (versions up to 2.7.7) can be triggered remotely by a low-privileged attacker via improper resource handling in the `amf_nnrf_handle_nf_discover` function of `src/amf/nnrf-handler.c`. The AMF is a critical 5G core control-plane element; crashing or hanging it disrupts mobility management and NF discovery for all connected UEs and network functions. A public proof-of-concept exists (GitHub issue #4517), and a patch commit has been identified, though the fix originates in a fork rather than the mainline repository.
Race condition in Open5GS AMF up to version 2.7.6 allows a remote, low-privileged attacker to trigger concurrent NGAP Security Mode Command processing in gmm_state_security_mode (src/amf/gmm-sm.c), resulting in low availability impact. Publicly available exploit code exists (N2-SMC-Concurrent.zip), though no public exploit identified at time of analysis indicates active exploitation and this CVE is not listed in CISA KEV. Notably, the associated fix PR (#4501) addresses a broader NGAP identity-scoping flaw - where the AMF accepted UE-associated NGAP messages from any gNB regardless of which gNB originally registered the UE - suggesting the underlying attack surface may exceed what the formal CVSS score of 3.1 captures.
Authentication bypass in Open5GS versions up to 2.7.6 allows remote attackers to manipulate UE security capabilities through the AMF's NGAP PathSwitchRequest message handler in src/amf/ngap-handler.c. The flaw stems from the AMF blindly overwriting locally stored UE 5G security capabilities with values received from a target gNB during a path switch, violating 3GPP TS 33.501 6.7.3.1, and publicly available exploit code exists though no public exploit identified as actively exploited at time of analysis.
Denial of service in Open5GS up to version 2.7.7 is triggerable by a low-privileged remote attacker via the `ogs_pool_id_calloc` function in the SBI nghttp2-server library, causing availability degradation of 5G core network functions. The CVSS temporal modifiers confirm both a public proof-of-concept (E:P) and an official remedy (RL:O). No public exploit identified at time of analysis as confirmed by CISA KEV, but the publicly available PoC on GitHub (issue #4474) materially lowers the exploitation barrier for actors with access to SBI endpoints.
Timer pool exhaustion in Open5GS up to 2.7.7 allows an authenticated remote attacker with low privileges to crash the UE authentication service via rapid HTTP/2 stream resets against the ue-authentications SBI endpoint. The root cause is CWE-404: response timers for outbound SBI transactions are not released when the originating inbound HTTP/2 stream closes prematurely (via RST_STREAM or connection drop), causing the timer pool to exhaust when a peer resets streams rapidly while upstream network functions are slow or unresponsive. No public exploit identified at time of analysis as KEV status, but a publicly available exploit code exists via GitHub issue #4473, and an upstream fix is available in PR #4578.
Denial-of-service via reachable assertion in Open5GS NRF (Network Repository Function) up to version 2.7.7 allows an authenticated low-privilege network peer to crash the NRF process with SIGABRT by submitting a crafted NFProfile registration payload with oversized inner-list arrays in SMF or AMF info sections. The NRF is a critical singleton service registry in 5G Service-Based Architecture - crashing it disrupts NF discovery for the entire 5G core, making the practical operational impact greater than the A:L CVSS impact rating alone suggests. Publicly available exploit code exists (GitHub issue #4469 and CVSS temporal E:P), though no confirmed active exploitation via CISA KEV has been recorded at time of analysis.
Out-of-bounds write in Open5GS versions up to 2.7.7 allows a remote, low-privileged attacker to crash the NRF (Network Repository Function) component by sending a malformed SCP info payload, resulting in a denial-of-service condition. The vulnerability resides in the handle_scp_info function within the Shared NF-profile Parser (lib/sbi/nnrf-handler.c), a critical parsing path for 5G service-based interface communication. A public proof-of-concept exploit has been disclosed via the project's GitHub issue tracker, materially lowering the bar for exploitation against unpatched deployments.
Denial of service in Open5GS NRF (Network Repository Function) through version 2.7.7 allows an authenticated network peer to crash the NRF process with SIGABRT by submitting a crafted SMF or AMF NF-profile registration containing oversized inner-loop arrays. The NRF's shared NF-profile parser in lib/sbi/nnrf-handler.c used reachable ogs_assert() calls - rather than graceful bounds checks - to enforce limits on DNN entries per S-NSSAI slice and TAC range entries per TAI range, making them triggerable by peer-supplied payloads. Publicly available exploit code exists (GitHub issue #4467); the CVSSv4 score of 2.1 reflects scoped low-availability impact but understates operational risk given the NRF's central role in 5G core service discovery.
Use-after-free vulnerability in Open5GS NRF component (versions up to 2.7.7) allows authenticated remote attackers to trigger denial of service via the discover_handler function in nghttp2-server.c. Publicly available exploit code exists (GitHub issue #4476), but vendor has not responded to early disclosure. EPSS data not available; CVSS 4.3 (Medium) reflects limited scope (DoS only, authenticated access required). Not listed in CISA KEV, indicating no confirmed widespread exploitation despite public POC.
Remote authenticated denial of service in Open5GS versions up to 2.7.7 allows attackers to crash the AUSF (Authentication Server Function) component via crafted timer manipulation. The vulnerability resides in ogs_timer_add function within nausf-handler.c. Public exploit code exists via GitHub issue #4472, though vendor has not responded to disclosure. EPSS data unavailable; CVSS 4.0 scores only 2.1 due to low availability impact and authenticated requirement, but the existence of public exploit elevates practical risk for exposed 5G core deployments.
Denial of service in Open5GS NRF (Network Repository Function) allows authenticated remote attackers to crash the service by exhausting the nf_service resource pool. Open5GS versions up to 2.7.7 fail to validate pool allocation during NF service registration, triggering assertion failures that terminate the process. Publicly available exploit code exists (GitHub issue #4466). EPSS data not available, not listed in CISA KEV. Patch released via commit 819db11a08b9736a3576c4f99ceb28f7eb99523a, merged in PR #4534.
Improper authorization in Open5GS AMF/MME component (versions up to 2.7.6) allows authenticated network attackers to manipulate NGAP user context lookups, potentially accessing or interfering with other users' 5G/LTE sessions. The vulnerability stems from insufficient validation of AMF_UE_NGAP_ID and RAN_UE_NGAP_ID pairs in the ran_ue_find_by_amf_ue_ngap_id function, enabling attackers with low-level network privileges to bypass session-to-base-station association controls. Publicly available exploit code exists (GitHub issue #4498), and a vendor-released patch (commit 5746b857) is available. CVSS 6.3 (Medium) reflects network vector with low attack complexity but requires authentication.
Denial of service vulnerability in Open5GS NRF client management (versions ≤2.7.7) allows authenticated remote attackers to crash the Network Repository Function service via malformed client pool arguments. Public exploit code exists (GitHub issue #4464), but vendor has not responded to disclosure. CVSS base score of 4.3 reflects low severity due to limited availability impact and authentication requirement. EPSS data not provided; KEV status not applicable for this unpatched issue.
Denial of service in Open5GS versions up to 2.7.6 allows authenticated remote attackers to crash the Network Repository Function (NRF) component via crafted nfInstanceId parameter manipulation in the ogs_sbi_nf_instance_set_id function. Publicly available exploit code exists (GitHub issue #4462), but vendor has not responded to early responsible disclosure. EPSS data not available, not listed in CISA KEV. CVSS 4.3 (Medium) reflects low impact (availability only) and authenticated attack vector.
Denial of service in Open5GS versions up to 2.7.7 allows authenticated remote attackers to crash the Network Repository Function (NRF) component by manipulating service-names or snssais parameters in SBI messages. A public proof-of-concept exploit exists via GitHub issue #4460, and the vendor has not responded to the early disclosure. EPSS data unavailable, but the low CVSS 4.3 score reflects limited impact (availability only, authenticated access required), reducing real-world urgency for most deployments.
Denial of service in Open5GS versions up to 2.7.7 allows authenticated remote attackers to crash the Network Repository Function (NRF) component via malformed target-plmn-list parameters. The vulnerability targets a parsing function in the Service-Based Interface (SBI) library and has publicly available exploit code (GitHub issue #4458). CVSS 4.3 reflects low severity, but the vendor has not responded to early disclosure attempts, leaving no confirmed patch timeline. EPSS and KEV data unavailable - exploitation likelihood beyond POC unknown.
Denial of service in Open5GS up to version 2.7.7 allows authenticated remote attackers to crash the NRF component by manipulating the hnrf-uri argument passed to the yuarel_parse function in /lib/sbi/conv.c. The vulnerability has a publicly available exploit and low CVSS score (4.3) due to authentication requirement and limited scope, but affects a critical 5G network function with potential operational impact.
Denial of service in Open5GS NRF component up to version 2.7.7 allows remote authenticated attackers to exhaust the nf_service memory pool via the ogs_nnrf_nfm_handle_nf_profile function, causing the process to abort via failed assertion. Publicly available exploit code exists, and a vendor patch is available but awaits acceptance into the main branch.
Denial of service in Open5GS through version 2.7.7 allows authenticated remote attackers to crash the Service Management Function (SMF) by manipulating the smf_nsmf_handle_update_data_in_vsmf function in nsmf-handler.c. Publicly available exploit code exists, and the project maintainers have not yet responded to the early disclosure notification despite awareness of the issue.
Denial of service in Open5GS up to version 2.7.7 allows authenticated remote attackers to crash the Session Management Function (SMF) by manipulating the qosFlowProfile argument in the smf_nsmf_handle_update_data_in_vsmf function. Publicly available exploit code exists, and the vulnerability affects the 5G core network's ability to manage quality-of-service parameters, though the project maintainers have not yet responded to early disclosure.
Denial of service in Open5GS SMF (Session Management Function) via crafted PDU Session Modification messages allows remote authenticated attackers to trigger unvalidated parameter processing in gsm_handle_pdu_session_modification_qos_flow_descriptions(), causing service disruption. The vulnerability stems from insufficient pre-validation of QoS flow parameter identifiers and bitrate units before state mutation, potentially leaving the SMF in an inconsistent state. Publicly available exploit code exists, and a fix awaits upstream acceptance in PR #4513.
Denial of service in Open5GS up to version 2.7.7 allows authenticated remote attackers to crash the Session Management Function (SMF) via manipulation of QoS rule parsing in the ogs_nas_parse_qos_rules function. The vulnerability has a low CVSS score of 2.1 but public exploit code is available; however, exploitation requires prior authentication and causes only availability impact without confidentiality or integrity compromise.
Denial of service vulnerability in Open5GS up to version 2.7.7 affects the SMF (Session Management Function) component's smf_nsmf_handle_create_sm_context function, allowing authenticated remote attackers to crash or degrade the 5G core network service through malformed session context creation requests. Public exploit code exists and the vulnerability has low real-world severity (CVSS 2.1) due to requirement for authenticated access and availability impact only, though active 5G infrastructure targeting remains a concern given the critical nature of SMF in telecom deployments.
Denial of service in Open5GS up to version 2.7.7 affects the SMF component's OpenAPI_list_create function, allowing authenticated remote attackers to cause service unavailability through resource manipulation. The vulnerability has low to moderate severity (CVSS 4.3) with publicly disclosed proof-of-concept code, though the vendor has not yet responded to early disclosure notification.
Remote authenticated denial of service in Open5GS up to version 2.7.7 affects the SMF (Session Management Function) component, specifically in the smf_nsmf_handle_created_data_in_vsmf function. An authenticated attacker can remotely trigger a denial of service condition by sending crafted requests. Public exploit code is available (CVE-2026-8267 GitHub issue #4448), though the vendor has not yet released a patched version despite early notification.
Denial of service in Open5GS up to version 2.7.7 allows authenticated remote attackers to crash the Service Management Function (SMF) via manipulation of the PDU session establishment acceptance function, resulting in service unavailability. The CVSS score of 4.3 reflects low severity due to authentication requirements and availability-only impact, though publicly available exploit code exists and the vulnerability has been reported to the project without acknowledged response.
Null pointer dereference in Open5GS Session Management Function (SMF) up to version 2.7.7 allows authenticated remote attackers to cause denial of service by manipulating the smf_nsmf_handle_create_data_in_hsmf function. Publicly available exploit code exists, and the project has been notified but has not yet released a patch.
Denial of service in Open5GS up to version 2.7.7 allows authenticated remote attackers to crash the Service Mobile Function (SMF) component via manipulation of the update_authorized_pcc_rule_and_qos function in the Policy and Charging Control (PCC) handler. The vulnerability has a CVSS score of 2.1 with low availability impact; publicly available exploit code exists, and the project maintainers have not yet responded to early disclosure.
Denial of service in Open5GS up to version 2.7.7 via the smf_n4_build_qos_flow_to_modify_list function in the SMF (Session Management Function) component allows remote authenticated attackers to crash the service with low attack complexity. The vulnerability has been publicly disclosed with exploit code available; the vendor was notified early but has not yet released a fix.
Denial of service vulnerability in Open5GS up to version 2.7.7 allows authenticated remote attackers to crash the Service Measurement Function (SMF) component via improper handling in the update_authorized_pcc_rule_and_qos function. The vulnerability has a publicly available exploit and moderate CVSS score (4.3) but is limited to authenticated access and results in availability impact only. The vendor has not yet released a patch despite early notification through a GitHub issue.
Denial of service in Open5GS up to version 2.7.7 allows authenticated remote attackers to crash the Service Mobility Function (SMF) component via manipulation of the update_authorized_pcc_rule_and_qos function in npcf-handler.c. Publicly available exploit code exists, and the vendor has not released a patch despite early notification through issue tracking.
Denial of service vulnerability in Open5GS up to version 2.7.7 allows remote unauthenticated attackers to crash the service by triggering improper exception handling in the ogs_pcc_rule_install_flow_from_media function within the PCC rule processing library. Publicly available exploit code exists, and the project maintainers have not responded to the early notification despite issue tracking.
Denial of service in Open5GS up to version 2.7.7 allows remote unauthenticated attackers to crash the Policy Control Function (PCF) by manipulating the SmPolicyContextData.ipv6AddressPrefix parameter in the pcf_sess_set_ipv6prefix function. The vulnerability has publicly available exploit code and was disclosed despite vendor non-responsiveness, making it a known attack vector against 5G service provider infrastructure.
Denial of service in Open5GS up to version 2.7.7 via manipulation of the pcf_sess_sbi_discover_and_send function in the sm-policies endpoint allows remote unauthenticated attackers to disrupt service availability. Publicly available exploit code exists, and the upstream project has not yet issued a patch despite early notification via issue report.
Remote denial of service in Open5GS up to version 2.7.7 affects the sm-policies endpoint's pcf_nbsf_management_handle_register function, allowing unauthenticated network attackers to trigger a crash or service disruption with low attack complexity. Publicly available exploit code exists and the vendor was notified early but has not released a fix.
Denial of service in Open5GS up to version 2.7.7 allows remote unauthenticated attackers to crash the Policy Control Function (PCF) service by sending crafted requests to the delete endpoint in the SM policy control handler (pcf_npcf_smpolicycontrol_handle_delete). The vulnerability has a publicly available proof of concept and impacts the availability of 5G network policy enforcement, though the vendor has not yet released a patch despite early notification.
Out-of-bounds read in Open5GS up to version 2.7.7 allows remote attackers to trigger information disclosure via manipulation of the ogs_sbi_client_send_via_scp_or_sepp function in lib/sbi/client.c during Service-Based Interface (SBI) communication. The vulnerability exploits improper bounds checking when extracting paths from URIs, affecting the Network Function (NF) component. CVSS 6.9 (network-accessible, low complexity, no privileges required) with availability impact. Upstream patch commit d5bc487fcf9ea87d2b03f2ef95123af344773bfb available.
Denial of service in Open5GS User Plane Function (UPF) up to version 2.7.7 allows remote, unauthenticated attackers to exhaust server resources through manipulation of GTPv1-U packet handling in the _gtpv1_u_recv_cb function. The vulnerability enables resource consumption attacks against 5G core network infrastructure without requiring authentication or user interaction. Vendor notification occurred via GitHub issue #4492 but has not received developer response or a released patch.
Denial of service in Open5GS up to version 2.7.7 affects the NSSF component's ogs_sbi_discovery_option_add_snssais function, allowing authenticated remote attackers to crash the service via a network request. The vulnerability has been publicly disclosed with exploit code available on GitHub, though the vendor has not yet responded to early notification.
Denial of service vulnerability in Open5GS up to version 2.7.7 affects the NSSF component's service discovery function, allowing remote authenticated attackers to cause availability impact through manipulation of the ogs_sbi_discovery_option_add_service_names function. Public exploit code exists and the vulnerability carries low CVSS score (2.1) reflecting limited impact scope, though the project has not yet responded to early notification.
Denial of service in Open5GS up to version 2.7.7 allows authenticated remote attackers to crash the NSSF (Network Slice Selection Function) component via a crafted PLMN list in the SBI (Service Based Interface) parser. The vulnerability exists in the ogs_sbi_parse_plmn_list function within /lib/sbi/conv.c and has been publicly disclosed with exploit code available; the vendor has not yet released a patch despite early notification.
Denial of service in Open5GS up to version 2.7.7 allows authenticated remote attackers to manipulate the NSSF network selection function via the nssf_nnrf_nsselection_handle_get_from_amf_or_vnssf handler in /src/nssf/nnssf-handler.c, causing service unavailability. Public exploit code exists and the vulnerability has been reported to the project, though no patch has been released as of analysis time.
Denial of service in Open5GS up to version 2.7.7 affects the NSSF component's stream identification function in the nghttp2-server library. Local authenticated attackers can manipulate the ogs_sbi_stream_find_by_id function to cause service unavailability. Publicly available exploit code exists, though the vendor has not yet responded to early disclosure notification.
Denial of service in Open5GS up to version 2.7.7 affects the AMF 3GPP access endpoint handler (udm_nudm_uecm_handle_amf_registration_update function), allowing authenticated remote attackers to crash the UDM service via malformed registration update messages. Publicly available exploit code exists, and the vendor was notified early but has not released a patch as of the analysis date.
Denial of service in Open5GS up to version 2.7.7 affects the udm_state_operational function in the smf-registrations endpoint, allowing authenticated remote attackers to manipulate the function and cause service unavailability. The vulnerability has publicly available exploit code and carries a low CVSS score of 2.1 due to required authentication and limited availability impact, though the project has not yet responded to early disclosure.
Denial of service in Open5GS up to version 2.7.7 affects the authentication-subscription endpoint handler, allowing authenticated remote attackers to manipulate the udm_nudr_dr_handle_subscription_authentication function and cause service unavailability. Public exploit code exists and the vulnerability has been reported to the project without a confirmed vendor response or patch release.
Denial of service in Open5GS UDR component up to version 2.7.7 allows authenticated remote attackers to crash the subscription data service by manipulating the supi_id argument to the ogs_dbi_subscription_data function. Publicly available exploit code exists, and the vendor has been notified via issue report but has not yet released a patch.
Denial of service in Open5GS UDR component (versions up to 2.7.7) via malformed pei argument in udr_nudr_dr_handle_subscription_context function allows authenticated remote attackers to crash the User Data Repository service with low complexity. Publicly available exploit code exists; vendor has not responded to early notification.
Denial of service in Open5GS versions up to 2.7.7 allows authenticated remote attackers to crash the AMF (Access and Mobility Management Function) component by exploiting improper error handling in the gmm_handle_service_request function. The vulnerability requires low-privilege authentication to trigger and results in service unavailability. A public exploit has been disclosed via GitHub issue tracker, though the vendor has not yet released a patch despite early notification.
Denial of service in Open5GS AMF (Access and Mobility Function) up to version 2.7.6 allows authenticated remote attackers to cause service unavailability by sending crafted registration requests with manipulated reg_type arguments. The vulnerability exists in the GMM (Mobility Management) handler due to insufficient validation of registration type values, potentially triggering null pointer dereferences or assertion failures. Vendor-released patch version 2.7.7 is available.
Denial of service in Open5GS AMF component up to version 2.7.7 allows authenticated remote attackers to trigger resource exhaustion via improper handling of PDU session context update messages in the amf_nsmf_pdusession_handle_update_sm_context function. The vulnerability has a low CVSS score (2.1) but publicly available exploit code exists; however, exploitation requires prior authentication to the 5G network, significantly limiting real-world attack surface.
Denial of service in Open5GS up to version 2.7.7 affects the AMF (Access and Mobility Function) component, specifically the ogs_id_get_value function in nudm-handler.c, allowing remote authenticated attackers to cause service unavailability. Publicly available exploit code exists, and the vulnerability has been reported to the project via GitHub issue #4405 without vendor acknowledgment or patch release at time of analysis.
Denial of service in Open5GS up to version 2.7.7 allows authenticated remote attackers to crash the AMF (Access and Mobility Management Function) component via manipulation of the amf_nudm_sdm_handle_provisioned function in the NUDM handler. The vulnerability has publicly available exploit code and affects the authentication and mobility management core of 5G networks, requiring valid credentials to trigger but resulting in service unavailability. Public disclosure has occurred without vendor remediation at the time of analysis.
Denial of service in Open5GS up to version 2.7.7 allows authenticated remote attackers to crash the BSF (Binding Support Function) component by manipulating the ipv6Prefix argument in the bsf_sess_find_by_ipv6prefix function. The vulnerability has a low CVSS score of 2.1 due to requiring authentication and causing only availability impact, but publicly available exploit code exists and the vendor has not yet responded to early disclosure.
Denial of service in Open5GS up to version 2.7.7 allows remote unauthenticated attackers to crash the BSF (Binding Support Function) service by manipulating the ipv4Addr parameter in the /nbsf-management/v1/pcfBindings endpoint. The vulnerability has publicly available exploit code and affects a core 5G network function, creating operational risk for mobile networks relying on this open-source implementation.
Denial of service in Open5GS 2.7.6 via malformed CCA (Credit-Control-Answer) messages in the SMF (Session Management Function) component allows remote attackers to crash the service without authentication. The vulnerability affects the smf_gx_cca_cb, smf_gy_cca_cb, and smf_s6b functions in the CCA Message Handler, with publicly available exploit code demonstrating the attack despite high complexity requirements. CVSS 6.3 reflects the availability impact and remote attack vector, though exploitation requires crafted network conditions.
Denial of service in Open5GS through version 2.7.6 affects the CCA Handler component's callback functions, allowing unauthenticated remote attackers to crash the service. Public exploit code is available for this vulnerability. Upgrading to version 2.7.7 resolves the issue.
Open5GS 2.7.6 is vulnerable to denial of service through improper handling of S11 session response messages in the MME component, allowing remote unauthenticated attackers to crash the service. Public exploit code exists for this vulnerability, and the vendor has not yet provided a patch despite early notification.
Open5GS versions up to 2.7.6 are vulnerable to a denial of service condition in the SMF component's PDP context request handler, which can be triggered remotely without authentication. An attacker can exploit this reachable assertion flaw to crash the service, and public exploit code is currently available. No patch has been released by the project despite early notification of the issue.
Memory corruption in Open5GS up to version 2.7.6 allows remote attackers to cause denial of service through manipulation of the MME component's esm-build.c file. Public exploit code exists for this vulnerability, and the Open5GS project has not yet released a patch despite early notification.
Memory corruption in Open5GS versions up to 2.7.6 allows remote attackers to trigger a denial of service condition by manipulating the SGW-C session creation handler, with public exploit code already available. The vulnerability requires no authentication or user interaction and currently lacks a vendor patch, leaving affected deployments vulnerable to remote availability attacks.
Open5GS versions up to 2.7.6 are vulnerable to a denial of service attack in the SMF component's TFT parsing function when a crafted packet manipulates the traffic filter content length parameter. An unauthenticated remote attacker can trigger this flaw to crash the service, and public exploit code exists with no patch currently available.
Open5GS versions up to 2.7.6 suffer from a null pointer dereference in the PGW S5U Address Handler component that can be triggered remotely without authentication, resulting in denial of service. Public exploit code exists for this vulnerability, and administrators should apply the available patch immediately.
A security flaw has been discovered in Open5GS up to 2.7.6. Affected by this vulnerability is the function hss_ogs_diam_cx_mar_cb of the file src/hss/hss-cx-path.c of the component VoLTE Cx-Test. [CVSS 7.3 HIGH]
Remote denial of service in Open5GS up to version 2.7.6 allows unauthenticated attackers to trigger a reachable assertion in the SGWC component by manipulating PDR arguments in the sgwc_tunnel_add function. Public exploit code exists for this vulnerability, and no patch is currently available despite reports indicating a fix is planned.
Open5GS versions up to 2.7.6 contain a reachable assertion vulnerability in the CreateBearerRequest handler that allows unauthenticated remote attackers to trigger a denial of service condition. Public exploit code exists for this vulnerability, and no patch is currently available. The impact is limited to service availability, with a CVSS score of 5.3.
Open5GS versions up to 2.7.6 contain a reachable assertion vulnerability in the SGWC S11 handler that can be triggered remotely without authentication to cause a denial of service. Public exploit code exists for this vulnerability, and while a patch is reported as already-fixed, it remains unavailable for affected deployments.
Denial of service in Open5GS up to version 2.7.6 allows remote attackers to crash the SGWC service by manipulating the Modify Bearer Request handler in s11-handler.c. Public exploit code exists for this vulnerability and no patch is currently available. Organizations running affected versions should apply updates as they become available and consider network-level mitigations to restrict access to the S11 interface.
Remote denial of service in Open5GS up to version 2.7.5 affects the SGWC component's TEID-to-IP conversion function, allowing unauthenticated attackers to crash the service over the network. Public exploit code exists for this vulnerability, and while a fix has been developed, no official patch is currently available for affected deployments.
Remote denial of service in Open5GS up to version 2.7.6 affects the SGWC component's bearer response handler, allowing unauthenticated attackers to crash the service over the network. Public exploit code exists for this vulnerability, though a patch (commit b19cf6a) is available to resolve it.
Remote denial of service in Open5GS up to version 2.7.6 allows unauthenticated attackers to crash the SGWC component by manipulating bearer resource failure indication messages. Public exploit code exists for this vulnerability, and a patch is available in commit 69b53add90a9479d7960b822fc60601d659c328b.
Open5gs WebUI authentication can be bypassed by attackers who exploit the default hardcoded JWT signing key ("change-me") that is used when the JWT_SECRET_KEY environment variable is not configured. An attacker can forge valid JWT tokens to gain unauthorized access to the WebUI with limited confidentiality and integrity impacts. A patch is available to remediate this vulnerability by enforcing proper key configuration or using secure defaults.
A vulnerability was determined in Open5GS up to 2.7.6. Impacted is the function sgwc_s11_handle_downlink_data_notification_ack of the file src/sgwc/s11-handler.c of the component sgwc. [CVSS 5.3 MEDIUM]