Quick answers
- Is CVE-2026-78186 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-78186 being exploited in the wild.
- How severe is CVE-2026-78186?
- Medium severity, with a CVSS score of 4.3, published 24 August 2026.
- Which products and versions are affected?
- Open5GS up to 2.8.0.
- Is there a fix for CVE-2026-78186?
- A patch was published on 2026-08-24: Fix available in commit c9abe09421eb99bbf1cd7862a3d375e58a4eb9e4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-78186 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-78186?
- Check whether you run Open5GS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a reachable assertion in the HSS component (src/hss/hss-cx-path.c) triggered by improper validation of the User-Name Diameter AVP. An attacker can send a remote request with a zero-length User-Name or Public-Identity parameter, which passes through to ogs_hash_get() as an invalid hash key, causing an assertion failure and terminating the HSS process. The attack is remotely accessible without authentication. The fix (commit c9abe09) adds validation to reject empty Cx identity AVPs in UAR, MAR, SAR, and LIR requests, returning DIAMETER_INVALID_AVP_VALUE instead of crashing.
Affected products
- Open5GS Open5GS up to 2.8.0
Timeline
- 2026-08-24: disclosed
- 2026-08-24: patched: Fix available in commit c9abe09421eb99bbf1cd7862a3d375e58a4eb9e4