Executive brief
Open5GS is a 5G core network implementation used by telecommunications operators. A remote attacker can exploit a stack buffer overflow in the S6a Diameter interface (used for Home Subscriber Server communication) by sending a specially crafted message with a manipulated argument length, potentially leading to a denial of service or arbitrary code execution on the core network infrastructure.
Technical details
A stack-based buffer overflow vulnerability exists in the Diameter S6a interface handler functions (hss_ogs_diam_s6a_air_cb and hss_ogs_diam_s6a_ulr_cb) in src/hss/hss-s6a-path.c. The vulnerable code performs a memcpy operation without proper validation of the source buffer length (hdr->avp_value->os.len), allowing an attacker to copy arbitrary amounts of data onto the stack. The attack is network-reachable and requires no authentication. Successful exploitation could lead to code execution or denial of service of the HSS component. The vulnerability affects versions up to 2.7.1 and is patched in version 2.7.2 (commit e89aa79efe629ae90f59dcdf8847c117d9a7da86).
Affected products
- Open5GS Open5GS up to 2.7.1
Timeline
- 2026-08-11: disclosed
- 2.7.2: patched: Patch commit e89aa79efe629ae90f59dcdf8847c117d9a7da86