Executive brief
Open5GS is an open-source implementation of 5G core network components, including the User Data Management (UDM) service. A defect in the UDM's handling of malformed API requests can cause the service to crash, disrupting 5G authentication and user registration services for all subscribers. An attacker with network access to the UDM interface can trigger this crash remotely by sending a crafted request missing required parameters.
Technical details
The vulnerability is a reachable assertion in the NUDM-UECM (UDM/UECM) interface of Open5GS v2.7.6. When a DELETE request to the SMF registration endpoint omits the required pduSessionId path parameter, the code path reaches an assertion check that fails, causing an immediate process termination (FATAL). The vulnerability is triggered via a network-reachable HTTP/2 DELETE request to the UDM service on the standard NUDM interface. No authentication is required to exploit this DoS condition. The fix has already been applied in the Open5GS codebase (marked as status:already-fixed), indicating a patch is available.
Affected products
- Open5GS Open5GS v2.7.6
Timeline
- 2026-01-08: disclosed: Bug reported on GitHub issue #4264
- 2026-08-27: advisory: NVD advisory published
- patched: Fix already integrated into Open5GS codebase (status:already-fixed)