Executive brief
Open5GS is an open-source implementation of 5G and 4G mobile core networks. A vulnerability in its Network Slice Selection Function (NSSF) allows a remote user to crash the service by sending a specifically crafted network request. This results in a denial of service, potentially disrupting mobile connectivity for users relying on that network core.
Technical details
A denial of service vulnerability exists in Open5GS up to version 2.7.7 within the Network Slice Selection Function (NSSF) component. The flaw is located in the function 'nssf_nnrf_nsselection_handle_get_from_amf_or_vnssf' in 'src/nssf/nnssf-handler.c'. The root cause is an 'ogs_assert' call that triggers a process crash when a Home Routed Roaming request (containing 'home-plmn-id' and 'homeSnssai') is received while the local NSSF configuration lacks a defined serving PLMN. An attacker with network access to the NSSF can trigger this crash remotely via a crafted HTTP/2 GET request to the '/nnssf-nsselection/v2/network-slice-information' endpoint. As of the advisory date, the project has been informed but a formal patch has not been confirmed.
Affected products
- Open5GS Open5GS up to 2.7.7
Timeline
- 2026-04-20: disclosed: Issue reported on GitHub repository
- 2026-05-08: advisory: VulDB and NVD publication