Executive brief
Open5GS is an open-source implementation of 5G and LTE core network functions. A vulnerability in how it processes network function profiles allows a remote attacker to crash the service by sending specially crafted, oversized data lists. This results in a denial of service, potentially disrupting mobile network connectivity and core operations.
Technical details
A denial of service vulnerability exists in Open5GS up to version 2.7.7 within the Shared NF-profile Parser (lib/sbi/nnrf-handler.c). The issue stems from the use of 'ogs_assert()' when parsing attacker-controlled list lengths that exceed fixed-size internal buffers, specifically within 'amfInfo.taiRangeList[*].tacRangeList' and 'smfInfo.sNssaiSmfInfoList[*].dnnSmfInfoList'. A remote attacker with access to the Service Based Architecture (SBA) can trigger a SIGABRT crash by registering a Network Function (NF) with more than 16 entries in these lists. This affects multiple components including the NRF, AMF, and SMF. A patch has been proposed to replace these assertions with graceful error handling and to implement pre-validation (HTTP 400) at the registration boundary.
Affected products
- Open5GS Open5GS up to 2.7.7
Timeline
- 2026-04-22: disclosed: Issue reported on GitHub
- 2026-05-06: patched: Pull request submitted to fix the issue
- 2026-05-30: advisory: CVE published