Threat Intelligence Database

A high-severity vulnerability (CVE-2026-92417) exists in Open5GS up to version 2.8.0 in the PFCP Handler component. The flaw is a null pointer dereference in the function ogs_pfcp_parse_volume_measurement within lib/pfcp/types.c. This vulnerability can be triggered remotely and may cause a denial of service. A patch identified by commit 8f07b507b78ff94776f2cd49276eb116ed93d7f2 is available to remediate the issue.

CVE-2026-92417 is a high-severity vulnerability in Open5GS up to version 2.8.0. It involves a null pointer dereference in the function ogs_pfcp_parse_volume_measurement within the PFCP Handler component. This flaw can be triggered remotely and may cause a denial of service or crash. A patch identified by commit 8f07b507b78ff94776f2cd49276eb116ed93d7f2 is available to remediate the issue.

CVE-2026-92416 is a medium-severity vulnerability in Open5GS up to version 2.8.0. It affects the PFCP Session Report Request Handler component, specifically the function smf_n4_handle_session_report_request. The vulnerability allows remote attackers to trigger a reachable assertion, potentially causing a denial of service or disruption. A patch identified by commit e5f0c06d0f2d9613b003daa1cfa3ba8a4bd157e9 is available to address this issue.

A security flaw has been discovered in Open5GS up to 2.7.7. Affected by this vulnerability is an unknown functionality of the file lib/pfcp/handler.c of the component PFCP Message Handler. Performing a manipulation results in denial of service. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The patch is named 028e1dbb5e3271035ccee906ef417a97fc523f71. Applying a patch is the recommended action to fix this issue. CVE-2025-29339 describes a different assertion failure vulnerability in Open5GS UPF.

A security flaw has been discovered in Open5GS up to 2.7.x. Affected is the function amf_nnrf_try_old_amf_discovery_fallback of the file src/amf/nnrf-handler.c of the component Old AMF Discovery Fallback. The manipulation of the argument discovery_option results in use after free. The attack may be performed from remote. The patch is identified as ddd683a35f8aaac2b7b9884a24cd53bddfc65238. Applying a patch is advised to resolve this issue.

CVE-2026-78186 is a medium severity vulnerability in Open5GS up to version 2.8.0. It involves a reachable assertion flaw in the HSS component, specifically in the src/hss/hss-cx-path.c file. The vulnerability is triggered by manipulation of the User-Name argument and can be exploited remotely. An exploit has been published. A patch identified by commit c9abe09421eb99bbf1cd7862a3d375e58a4eb9e4 is available to fix this issue.

A vulnerability in Open5GS 2.8.0 affects the Rx AA-Request Handler component, specifically the function pcrf_rx_aar_cb. This vulnerability allows a remote attacker to cause an out-of-bounds read by manipulating input. The issue is identified as CVE-2026-78157 and has a CVSS score of 7.4. A patch has been created to address this vulnerability, but no explicit patch link or vendor advisory is provided in the data.

Open5GS version 2.8.0 contains a heap-based buffer overflow vulnerability in the S6a Authentication-Information-Request Handler component. The flaw exists in the function hss_ogs_diam_s6a_air_cb when processing the Visited-PLMN-Id argument. This vulnerability can be exploited remotely and may lead to partial confidentiality, integrity, and availability impact. A patch identified by commit a9c82ee0b590d76a581b0580cb46b598984e2392 addresses this issue.

CVE-2026-78158 is a medium severity vulnerability in Open5GS version 2.8.0 involving improper authorization in the AMF UEContextReleaseRequest Path Handler component. The flaw allows remote attackers with low privileges to manipulate the system, potentially bypassing authorization controls. No patch or vendor advisory is currently provided, and no known exploits are reported in the wild.

CVE-2026-78157 is an out-of-bounds read vulnerability in Open5GS version 2.8.0 affecting the pcrf_rx_aar_cb function in the Rx AA-Request Handler component. The vulnerability can be triggered remotely by manipulating input to this function. A patch has been identified to fix this issue.