Executive brief
Open5GS is an open-source implementation of 5G Core and EPC mobile network functions. A vulnerability in its Session Management Function (SMF) allows a remote attacker to crash the service by sending a specially crafted network request. This results in a denial of service, potentially disrupting mobile connectivity for users relying on the affected core network.
Technical details
A denial of service vulnerability exists in the Open5GS Session Management Function (SMF) due to an out-of-bounds write in the update_authorized_pcc_rule_and_qos function within /src/smf/npcf-handler.c. The software fails to validate the number of Policy and Charging Control (PCC) rules provided in an 'sm-policy-notify' callback against the fixed array size (OGS_MAX_NUM_OF_PCC_RULE, which is 8). An attacker with network access to the SMF's Npcf interface can send a POST request with more than 8 PCC rules, leading to memory corruption and a process crash via a failed assertion (ogs_assert). This issue affects versions up to 2.7.7; as of the advisory date, the project has been notified but a formal patch has not been confirmed.
Affected products
- Open5GS Open5GS up to 2.7.7
Timeline
- 2026-04-20: disclosed: Issue reported on GitHub repository
- 2026-05-10: advisory: CVE published and NVD entry created