Quick answers
- Is CVE-2026-37198 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-37198 being exploited in the wild.
- How severe is CVE-2026-37198?
- High severity, with a CVSS score of 7.5, published 27 August 2026.
- Which products and versions are affected?
- Open5GS v2.7.6.
- Is there a fix for CVE-2026-37198?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-37198 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-37198?
- Check whether you run Open5GS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An integer overflow exists in the SMF component of Open5GS v2.7.6 when processing GTP control messages, specifically in the handling of Bearer Context information elements. The vulnerability occurs due to insufficient validation of the number and structure of these IEs during packet parsing. An attacker can exploit this remotely by crafting a malicious GTP packet that triggers the integer overflow, leading to a crash of the SMF service. No authentication is required to send GTP packets to the network element. A fix is required from the Open5GS maintainers.
Affected products
- Open5GS Open5GS v2.7.6
Timeline
- 2026-05-12: disclosed
- 2026-08-27: advisory