Executive brief
Open5GS is an open-source implementation of 5G and LTE mobile core networks. A security flaw in its authentication component allows a remote attacker to crash the service by exhausting internal resources. This results in a denial of service, preventing mobile devices from authenticating or connecting to the network.
Technical details
A resource management vulnerability (CWE-404) exists in Open5GS up to version 2.7.7 within the Service Based Interface (SBI) transaction handling. Specifically, the function 'ogs_sbi_xact_add' in 'lib/core/ogs-timer.c' fails to properly release outbound transactions when an inbound stream is closed. By repeatedly sending authentication requests (such as NAUSF or 5G-AKA confirmation), a remote attacker can exhaust the transaction and timer pools. This leads to a denial of service (DoS) as the Authentication Server Function (AUSF) or other Network Functions (NF) crash or fail to process new requests. A patch has been merged into the main branch to automatically cancel pending outbound transactions upon stream closure.
Affected products
- Open5GS Open5GS up to 2.7.7
Timeline
- 2026-04-23: disclosed: Issue reported on GitHub
- 2026-05-24: patched: Fix merged into main branch via Pull Request 4578
- 2026-05-30: advisory: CVE published