Executive brief
Open5GS is an open-source implementation of 5G and LTE mobile core networks. A vulnerability in its Session Management Function (SMF) allows a remote attacker to crash the service by sending a specially crafted network policy update. This results in a denial of service, potentially disrupting mobile connectivity for users on the affected network.
Technical details
A denial of service vulnerability exists in the Open5GS Session Management Function (SMF) component due to improper handling of OpenAPI enum values. Specifically, the function 'update_authorized_pcc_rule_and_qos' in 'src/smf/npcf-handler.c' fails to validate the 'preemptCap' string within a SmPolicyDecision. When an invalid string is provided, the OpenAPI decoder returns 0, which subsequently triggers a failed assertion ('ogs_assert') in the SMF process. An attacker with network access to the SMF's callback interface can exploit this by sending a forged 'nsmf-callback' POST request, causing the SMF process to crash (SIGSEGV/exit code 139). As of the advisory date, the project has been informed but a formal patch has not been confirmed.
Affected products
- Open5GS Open5GS up to 2.7.7
Timeline
- 2026-04-20: disclosed: Issue reported on GitHub repository
- 2026-05-10: advisory: VulDB and NVD publication