Executive brief
Open5GS is an open-source implementation of a 5G Core network, which handles authentication and subscriber data for mobile networks. A vulnerability in the HSS (Home Subscriber Server) component allows an attacker to send a specially crafted Diameter protocol message that crashes the service, causing a denial of service. This impacts network availability and prevents legitimate subscribers from accessing mobile services.
Technical details
The vulnerability exists in the fd_msg_sess_get function of the freeDiameter library used by Open5GS's HSS Service. The issue is triggered when a malformed Update-Location-Request (ULR) Diameter message is sent with a missing or invalid Session-Id AVP, leading to an assertion failure in the message parsing code. An attacker with network access to the HSS (typically via SCTP connection to port 3868) can send a crafted Diameter message without authentication, causing the HSS process to crash. The root cause is insufficient validation of the Session-Id AVP before attempting to access it. Patches are available in versions after 2.7.6.
Affected products
- Open5GS Open5GS up to 2.7.6
Timeline
- 2025-12-01: disclosed: Issue reported publicly on GitHub (#4190)
- 2026-08-12: advisory: CVE-2025-15686 published
- 2025-12-01: other: Proof-of-concept exploit disclosed