Executive brief
Open5GS is an open-source implementation of the 5G core network and LTE infrastructure. A vulnerability in the diameter protocol message handler allows an attacker to craft a malformed message that triggers a fatal assertion, causing the network service to crash. This results in a denial of service affecting voice, data, and messaging services for subscribers.
Technical details
The vulnerability is a reachable assertion in the diam_log_func function within lib/diameter/common/init.c of the CER (Capabilities-Exchange-Request) handler. A malformed Diameter message containing duplicate Auth-Application-Id AVPs causes the freeDiameter library to call FD_LOG_FATAL, which triggers an ogs_assert_if_reached() call that invokes abort(), terminating the entire Open5GS daemon (HSS/MME/PCRF/AAA). The attack is remotely exploitable and requires no authentication. The fix removes the fatal assertion path to allow graceful rejection of invalid messages. A patch is available in version 2.7.7 (commit c1a803516a3c0485696cb9bcca7a80ad857c7383).
Affected products
- Open5GS Open5GS up to 2.7.6
Timeline
- 2026-08-12: disclosed
- 2026-08-12: patched: version 2.7.7 with commit c1a803516a3c0485696cb9bcca7a80ad857c7383