Executive brief
Open5GS is an open-source implementation of 5G and 4G mobile core networks. A flaw in the Session Management Function (SMF) allows a remote attacker to crash the service by sending a specially crafted network request. This results in a denial of service, potentially disrupting mobile connectivity for users on the affected network.
Technical details
A denial of service vulnerability exists in the Open5GS Session Management Function (SMF) component up to version 2.7.7. The vulnerability is located in the 'update_authorized_pcc_rule_and_qos' function within 'src/smf/npcf-handler.c'. The root cause is an improper resource release/null pointer dereference (CWE-404) where the SMF callback handler unconditionally attempts to duplicate a 'flowDescription' string using 'ogs_strdup' without verifying if the pointer is NULL. An attacker with the ability to send a 'POST' request to the 'sm-policy-notify' endpoint can trigger an assertion failure and process crash by omitting the 'flowDescription' field in the 'flowInfos' object. This requires an existing PDU session to be established.
Affected products
- Open5GS Open5GS up to 2.7.7
Timeline
- 2026-04-20: disclosed: Issue reported on GitHub repository
- 2026-05-10: advisory: CVE published