Executive brief
Open5GS is an open-source implementation of 5G Core and EPC network functions used in mobile telecommunications. A vulnerability in the Session Management Function (SMF) component allows a remote attacker to crash the service by sending a specially crafted notification message. This results in a denial of service, potentially disrupting mobile network connectivity for connected users.
Technical details
A vulnerability exists in Open5GS up to version 2.7.7 within the Session Management Function (SMF) component. The function `update_authorized_pcc_rule_and_qos` in `/src/smf/n4-build.c` fails to perform upper-bound checking when appending `flowInfos` elements to the `pcc_rule->flow` array. While the internal array is limited to 15 elements (`OGS_MAX_NUM_OF_FLOW_IN_PCC_RULE`), an attacker can provide a larger list via a forged `POST` request to the `nsmf-callback` endpoint. This leads to memory corruption and a subsequent process crash (SIGSEGV) during the PFCP build path. Exploitation requires an existing SMF session, making the attack vector network-based with low privileges.
Affected products
- Open5GS Open5GS up to 2.7.7
Timeline
- 2026-04-20: disclosed: Issue reported on GitHub repository
- 2026-05-10: advisory: CVE published