Executive brief
Open5GS is an open-source implementation of 5G and LTE core network functions. A vulnerability in how it handles network addresses (URIs) allows a remote attacker to crash the software by sending a specially formatted request that lacks a specific path component. This results in a denial-of-service, potentially disrupting mobile network connectivity for users.
Technical details
A denial-of-service vulnerability exists in Open5GS up to version 2.7.7 within the ogs_sbi_client_send_via_scp_or_sepp function in lib/sbi/client.c. The root cause is an unchecked return value from ogs_sbi_getpath_from_uri(); when a URI is provided without a path component (e.g., 'http://host:port'), the function returns NULL, triggering a subsequent ogs_assert(path) failure that aborts the process. A remote attacker can exploit this by supplying malformed URIs in SBI-based communications, such as NRF subscriptions. While some initial reports categorized this as an out-of-bounds read (CWE-125), the developer's analysis confirms it is an assertion failure leading to a crash. A patch has been released in commit d5bc487fcf9ea87d2b03f2ef95123af344773bfb.
Affected products
- Open5GS Open5GS up to 2.7.7
Timeline
- 2026-04-26: patched: Pull request 4496 submitted with fix
- 2026-05-08: patched: Fix merged into main branch
- 2026-05-09: disclosed: Vulnerability disclosed via VulDB/NVD
References
- https://github.com/open5gs/open5gs/
- https://github.com/open5gs/open5gs/commit/d5bc487fcf9ea87d2b03f2ef95123af344773bfb
- https://github.com/open5gs/open5gs/issues/4491
- https://github.com/open5gs/open5gs/pull/4496
- https://vuldb.com/submit/800024
- https://vuldb.com/vuln/362338
- https://vuldb.com/vuln/362338/cti