Executive brief
Open5GS is an open-source implementation of 5G and LTE mobile core networks. A vulnerability in its Network Slice Selection Function (NSSF) component can allow a local attacker to crash the service, leading to a denial of service. This occurs when a specific network request is interrupted, causing the system to improperly handle the remaining data and shut down unexpectedly.
Technical details
A denial of service vulnerability exists in Open5GS up to version 2.7.7 within the NSSF component. The issue is located in the ogs_sbi_stream_find_by_id function in /lib/sbi/nghttp2-server.c. It is triggered when a Home-NSSF selection request causes an outbound query, but the original client disconnects or times out before the response arrives. When the response finally arrives, the code attempts to retrieve the associated stream by ID; because the stream has been closed, the function returns NULL. An improper resource management (CWE-404) flaw leads to a failed assertion (ogs_assert(stream)), causing the NSSF process to crash. While the attack vector is described as local, it involves manipulating HTTP/2 stream states. As of the advisory date, no official patch has been confirmed by the vendor.
Affected products
- Open5GS Open5GS up to 2.7.7
Timeline
- 2026-04-20: disclosed: Issue reported on GitHub project page
- 2026-05-08: advisory: CVE published