Executive brief
Open5GS is an open-source implementation of 5G and LTE core network functions. A vulnerability in the Network Slice Selection Function (NSSF) component allows a remote user to crash the service by sending a specially crafted request. This results in a denial of service, potentially disrupting mobile network connectivity and slice management operations.
Technical details
A denial of service vulnerability exists in the Open5GS Network Slice Selection Function (NSSF) component due to improper handling of malformed JSON in Service Based Interface (SBI) discovery queries. Specifically, the function 'ogs_sbi_parse_plmn_list' in 'lib/sbi/conv.c' is called even when initial JSON parsing fails, leading to a NULL pointer dereference and a subsequent assertion failure (FATAL: ogs_sbi_parse_plmn_list: Assertion `PlmnList` failed). An attacker can trigger this by sending a GET request to the '/nnssf-nsselection/v2/network-slice-information' endpoint with a malformed 'target-plmn-list' or 'requester-plmn-list' parameter. This causes the NSSF process to crash (exit code 139). The vulnerability is present in versions up to 2.7.7.
Affected products
- Open5GS Open5GS up to 2.7.7
Timeline
- 2026-04-20: disclosed: Issue reported on GitHub repository
- 2026-05-08: advisory: CVE published