Executive brief
Open5GS is an open-source implementation of 5G and LTE core network functions. A vulnerability in how it processes network function profiles allows a remote attacker to crash core network services, such as the Network Repository Function (NRF) or Access and Mobility Management Function (AMF). This results in a denial-of-service condition that can disrupt mobile network operations and connectivity for users.
Technical details
A denial-of-service vulnerability exists in Open5GS up to version 2.7.7 within the shared SBI NF-profile parser (lib/sbi/nnrf-handler.c). The root cause is the use of 'ogs_assert()' on fixed-size array bounds when parsing 'dnnSmfInfoList' and 'tacRangeList' from peer-supplied JSON data. A remote attacker with access to the Service Based Architecture (SBA) can send a registration or discovery response containing more than 16 entries in these lists, triggering a SIGABRT and crashing the consuming network function (e.g., NRF, AMF, or SMF). A patch has been proposed to replace these assertions with graceful error handling and list truncation.
Affected products
- Open5GS Open5GS up to 2.7.7
Timeline
- 2026-04-22: disclosed: Issue reported on GitHub
- 2026-05-06: patched: Pull request submitted to fix the issue
- 2026-05-30: advisory: CVE published