Executive brief
Open5GS is an open-source implementation of 5G and LTE mobile core networks. A vulnerability in the Network Slice Selection Function (NSSF) component allows a remote attacker to crash the service by sending a specially crafted network request. This results in a denial of service, potentially disrupting mobile connectivity and network slice management for users.
Technical details
A denial of service vulnerability exists in the Open5GS NSSF component due to improper resource handling in the Service Based Interface (SBI) message parser. Specifically, the function 'ogs_sbi_discovery_option_add_snssais' in '/lib/sbi/message.c' utilizes a fatal assertion ('ogs_assert') when the number of S-NSSAIs in a discovery request exceeds the 'OGS_MAX_NUM_OF_SLICE' limit. A remote attacker with network access to the NSSF can trigger this assertion by sending a GET request to the '/nnssf-nsselection/v2/network-slice-information' endpoint with an oversized 'snssais' query parameter. This causes the NSSF process to terminate abruptly (SIGSEGV/exit code 139). As of the advisory date, the project has been notified but a formal patch has not been confirmed.
Affected products
- Open5GS Open5GS up to 2.7.7
Timeline
- 2026-04-20: disclosed: Issue reported on GitHub repository
- 2026-05-08: advisory: CVE published