Quick answers
- Is CVE-2026-106807 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-106807 being exploited in the wild.
- How severe is CVE-2026-106807?
- Informational severity, published 2 November 2026.
- Which products and versions are affected?
- Open5GS v2.8.0.
- Is there a fix for CVE-2026-106807?
- Yes: fixed in Commit d91af3b or later (transaction allocation failure handling in PFCP/GTP paths). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-106807 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-106807?
- Check whether you run Open5GS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: Commit d91af3b or later (transaction allocation failure handling in PFCP/GTP paths)
Technical details
The vulnerability is a resource exhaustion leading to an unhandled assertion failure in the PFCP transaction handling path. When ogs_pfcp_xact_remote_create() fails to allocate a transaction due to pool exhaustion, the NULL return is not checked, causing ogs_assert(new) to fail in ogs_pfcp_xact_receive(). An unauthenticated remote attacker able to send PFCP messages to SMF or UPF can trigger this by flooding the component, terminating it with SIGABRT and denying service until restart.
Affected products
- open5GS open5GS v2.8.0
Timeline
- 2026-11-02: disclosed