Executive brief
Open5GS is an open-source implementation of 5G and LTE core network functions. A vulnerability in the Network Slice Selection Function (NSSF) component allows a remote user to crash the service by sending a specially crafted network request. This results in a denial of service, potentially disrupting mobile network connectivity and slice management operations.
Technical details
A denial of service vulnerability exists in Open5GS up to version 2.7.7 within the Network Slice Selection Function (NSSF) component. The issue resides in the 'ogs_sbi_discovery_option_add_service_names' function in 'lib/sbi/message.c'. When parsing an HTTP/2 GET request to the Nnssf_NSSelection API, the parser fails to properly handle a 'service-names' query parameter that contains more items than the defined 'OGS_SBI_MAX_NUM_OF_SERVICE_TYPE' limit. This triggers a failed assertion ('ogs_assert'), causing the NSSF process to abort and exit (SIGSEGV/exit code 139). An attacker with network access to the SBI interface can exploit this remotely to cause a persistent denial of service.
Affected products
- Open5GS Open5GS up to 2.7.7
Timeline
- 2026-04-20: disclosed: Issue reported on GitHub repository
- 2026-05-08: advisory: CVE published