Executive brief
Open5GS is an open-source implementation of 5G core network infrastructure that handles authentication and subscriber data. A flaw in the HSS (Home Subscriber Server) component allows a remote attacker to send a specially crafted request with an empty User-Name argument, causing the service to crash and denying legitimate users access to the network.
Technical details
The vulnerability is a reachable assertion in the HSS component (src/hss/hss-cx-path.c) triggered by improper validation of the User-Name Diameter AVP. An attacker can send a remote request with a zero-length User-Name or Public-Identity parameter, which passes through to ogs_hash_get() as an invalid hash key, causing an assertion failure and terminating the HSS process. The attack is remotely accessible without authentication. The fix (commit c9abe09) adds validation to reject empty Cx identity AVPs in UAR, MAR, SAR, and LIR requests, returning DIAMETER_INVALID_AVP_VALUE instead of crashing.
Affected products
- Open5GS Open5GS up to 2.8.0
Timeline
- 2026-08-24: disclosed
- 2026-08-24: patched: Fix available in commit c9abe09421eb99bbf1cd7862a3d375e58a4eb9e4