Junglewise Threat Intelligence

CVE-2026-14618: Open5GS denial of service in AMF nnrf-handler

CVE-2026-14618 · Severity: medium · CVSS 4.3 · Published 2026-07-04

Technologies: Open5GS. Vendors: Open5GS.

Executive brief

A denial-of-service vulnerability exists in Open5GS, an open-source implementation of 5G and LTE core networks. The software's Access and Mobility Management Function (AMF) can crash when it receives certain network discovery responses after a user connection has already been terminated. This crash disrupts mobile network services and can be triggered remotely by an attacker with access to the network.

Technical details

A denial-of-service vulnerability exists in Open5GS up to version 2.7.7 within the Access and Mobility Management Function (AMF). The root cause is a race condition in 'src/amf/nnrf-handler.c' where the 'amf_nnrf_handle_nf_discover' function fails to validate the existence of a RAN-UE context before asserting it. If a gNB connection is terminated (e.g., via SCTP ABORT or graceful shutdown) while an NRF Discovery request is in flight, the subsequent discovery response triggers an 'ogs_assert(ran_ue)' failure on a NULL pointer, causing the AMF process to terminate. This can be exploited remotely by an authenticated attacker or through specific network conditions. A patch (commit fb5f677) has been released to replace the assertion with a defensive NULL check.

Affected products

  • Open5GS Open5GS up to 2.7.7

Timeline

  • 2026-05-03: other: Vulnerability reproduced in lab environment
  • 2026-07-04: advisory: NVD/VulDB publication date
  • 2026-07-04: patched: Patch identified as commit fb5f67703de0213fb9c6e6ef3b48b6c1707e9503

References

Related threats