Threats affecting pkg:github/open5gs

Open5GS 2.6.1 through 2.8.0 contains an out-of-bounds read vulnerability in parse_scheme_output() in lib/sbi/conv.c during SUCI de-concealment due to incomplete length validation. Remote unauthenticated UEs or SBI peers can submit a crafted SUCI with a 42-byte scheme output to a UDM, triggering a heap over-read past the buffer.

Open5GS versions 1.3.0 through 2.8.0 have a heap out-of-bounds write vulnerability in the parse_multipart() function. This flaw allows unauthenticated attackers to corrupt memory by sending a crafted multipart/related request with an empty multipart boundary to the SBI interface of any network function, causing a buffer overflow and potential crash.

CVE-2026-107166 is a medium severity vulnerability in Open5GS up to version 2.7.7. It affects the GTP-U Receive Path component, specifically the ogs_pfcp_xact_local_create function in src/upf/gtp-path.c. The flaw allows remote attackers to cause allocation of resources, potentially impacting system stability. A patch has been released to address this issue.

A vulnerability was found in Open5GS up to 2.8.0. This affects the function ogs_pfcp_parse_volume_measurement in the library lib/pfcp/types.c of the component PFCP Handler. The manipulation results in null pointer dereference. The attack may be launched remotely. The patch is identified as 8f07b507b78ff94776f2cd49276eb116ed93d7f2. A patch should be applied to remediate this issue.

CVE-2026-92416 is a medium-severity vulnerability in Open5GS up to version 2.8.0. It affects the PFCP Session Report Request Handler component, specifically the function smf_n4_handle_session_report_request. The vulnerability allows remote attackers to trigger a reachable assertion, potentially causing a denial of service or disruption. A patch identified by commit e5f0c06d0f2d9613b003daa1cfa3ba8a4bd157e9 is available to address this issue.

A security flaw has been discovered in Open5GS up to 2.7.7. Affected by this vulnerability is an unknown functionality of the file lib/pfcp/handler.c of the component PFCP Message Handler. Performing a manipulation results in denial of service. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The patch is named 028e1dbb5e3271035ccee906ef417a97fc523f71. Applying a patch is the recommended action to fix this issue. CVE-2025-29339 describes a different assertion failure vulnerability in Open5GS UPF.

A security flaw has been discovered in Open5GS up to 2.7.x. Affected is the function amf_nnrf_try_old_amf_discovery_fallback of the file src/amf/nnrf-handler.c of the component Old AMF Discovery Fallback. The manipulation of the argument discovery_option results in use after free. The attack may be performed from remote. The patch is identified as ddd683a35f8aaac2b7b9884a24cd53bddfc65238. Applying a patch is advised to resolve this issue.

CVE-2026-78186 is a medium severity vulnerability in Open5GS up to version 2.8.0. It involves a reachable assertion flaw in the HSS component, specifically in the src/hss/hss-cx-path.c file. The vulnerability is triggered by manipulation of the User-Name argument and can be exploited remotely. An exploit has been published. A patch identified by commit c9abe09421eb99bbf1cd7862a3d375e58a4eb9e4 is available to fix this issue.

CVE-2026-78158 is a medium severity vulnerability in Open5GS version 2.8.0 involving improper authorization in the AMF UEContextReleaseRequest Path Handler component. The flaw allows remote attackers with low privileges to manipulate the system, potentially bypassing authorization controls. No patch or vendor advisory is currently provided, and no known exploits are reported in the wild.

CVE-2026-78157 is an out-of-bounds read vulnerability in Open5GS version 2.8.0 affecting the pcrf_rx_aar_cb function in the Rx AA-Request Handler component. The vulnerability can be triggered remotely by manipulating input to this function. A patch has been identified to fix this issue.

CVE-2026-78156 is a heap-based buffer overflow vulnerability in Open5GS version 2.8.0. It affects the function hss_ogs_diam_s6a_air_cb in the S6a Authentication-Information-Request Handler component. The vulnerability arises from improper handling of the Visited-PLMN-Id argument, which can be manipulated remotely to trigger the overflow. A patch identified by commit a9c82ee0b590d76a581b0580cb46b598984e2392 is available to remediate this issue.

Open5GS version 2.7.0 contains a vulnerability in the ngap_send_to_nas() function within src/amf/ngap-path.c that allows a remote attacker to cause a denial of service. This issue is identified as CVE-2026-71675 and is classified with a high severity score of 7.5. The vulnerability does not impact confidentiality or integrity but affects availability by enabling denial of service. There is no information about patches or fixes currently available. No known exploits are reported in the wild at this time.

A buffer overflow vulnerability exists in Open5GS version 2.7.0 that can be triggered remotely via the NAS 5GS decoder chain. The flaw occurs when the message type byte of a NAS PDU is mutated, allowing an attacker to cause a denial of service condition.

A buffer overflow vulnerability exists in Open5GS up to version 2.7.1 in the Diameter Rx Handler component, specifically in the pcrf_rx_aar_cb function. This flaw is caused by improper handling of the arguments num_of_media_component and num_of_sub. The vulnerability can be exploited remotely. A public exploit is available. Upgrading to version 2.7.2 addresses this issue.

A security flaw has been discovered in Open5GS up to 2.7.6. Impacted is the function smf_gx_cca_cb of the component SMF Diameter Gx Credit-Control-Answer Handler. The manipulation results in denial of service. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 2.7.7 is recommended to address this issue. The patch is identified as f23d7a5e959acd8f37b925dc29b85f26b7d391cb. Upgrading the affected component is advised.

A vulnerability has been found in Open5GS up to 2.7.6. Affected by this issue is the function fd_msg_sess_get of the component HSS Service. Such manipulation of the argument Session-Id leads to denial of service. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The project locked and limited conversation to collaborators.

A flaw has been found in Open5GS up to 2.7.1. Affected by this vulnerability is an unknown functionality of the component freeDiameter. This manipulation causes memory corruption. The attack is possible to be carried out remotely.