Executive brief
Open5GS is the open-source implementation of 5G core network infrastructure, handling critical signaling between mobile network components. A memory corruption flaw in its bundled freeDiameter library can be triggered remotely by sending a malformed Diameter protocol message, causing the affected process to crash and disrupt 5G network operations. An attacker with network access to the Diameter signaling port can exploit this to cause denial of service against the mobile operator's core network.
Technical details
The vulnerability exists in freeDiameter's message parsing rules validation (parserules_check_one_rule in messages.c), where certain malformed Capability-Exchange-Request (CER) Diameter messages encounter an unimplemented error-handling branch. Instead of gracefully rejecting the message with an error code, the code invokes abort() unconditionally, terminating the worker process with SIGABRT. The attack is network-reachable; any entity sending Diameter traffic to the Open5GS Diameter listener (typically port 3868 via TCP or SCTP) can trigger the crash with a specially crafted CER packet. No authentication is required. The flaw causes denial of service by terminating active worker processes; a sustained attack could disable the 5G core network element.
Affected products
- Open5GS Open5GS up to 2.7.1
Timeline
- 2025-11-13: disclosed
- 2026-08-12: advisory