CVE-2026-82589: Denial of Service in Open5GS
Description
CVE-2026-82589 is a denial of service vulnerability in Open5GS versions 2.7.0 through 2.7.7. The flaw exists in the amf_namf_comm_handle_n1_n2_message_transfer function within the N1-N2 Message Handler component. Manipulating a specific argument in the N1N2MessageTransferReqData structure can cause the service to become unavailable. Exploit code has been publicly released. Upgrading to Open5GS version 2.8.0 is recommended to remediate the issue.
CVSS v4.0
Score 5.3medium
Affected software
Open5GS
cpe:2.3:a:open5gs:open5gs:*:*:*:*:*:*:*:*AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability affects Open5GS up to version 2.7.7 in the function amf_namf_comm_handle_n1_n2_message_transfer located in src/amf/namf-handler.c. An attacker can remotely trigger a denial of service by manipulating the argument N1N2MessageTransferReqData.n2InfoContainer.smInfo.n2InfoContent.ngapIeType. The vulnerability has a CVSS 4.0 base score of 5.3 (medium severity), indicating it is remotely exploitable with low attack complexity and no user interaction required. A patch identified by commit abf8a836564b966b5141110fc25ed413c4f17522 is available in Open5GS version 2.8.0 to fix this issue.
Potential Impact
Successful exploitation results in denial of service of the affected Open5GS component, potentially disrupting network functions relying on the N1-N2 Message Handler. The attack can be initiated remotely without user interaction and requires low privileges. There is no indication of data confidentiality or integrity impact. Public exploit code availability increases the risk of exploitation.
Mitigation Recommendations
A fix is available in Open5GS version 2.8.0. It is strongly recommended to upgrade affected deployments from versions 2.7.0 through 2.7.7 to version 2.8.0 or later. No other mitigations or workarounds are specified.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-08-30T06:09:51.384Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a94ad33acd9273b4915f992
Added to database: 08/30/2026, 22:22:43 UTC
Last enriched: 09/07/2026, 15:35:46 UTC
Last updated: 10/13/2026, 18:48:24 UTC
Views: 97
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.