Executive brief
Open5GS is an open-source 5G core network implementation that processes mobile network signaling messages. A vulnerability in the N1-N2 message handler allows a remote attacker to crash the AMF (Access and Mobility Management Function) component by sending a specially crafted message with an unsupported parameter value, causing a denial of service that disrupts mobile network operations.
Technical details
This is a null pointer dereference or crash vulnerability in the amf_namf_comm_handle_n1_n2_message_transfer function within src/amf/namf-handler.c. The vulnerability exists in the N1-N2 Message Handler component and is triggered by manipulating the N1N2MessageTransferReqData.n2InfoContainer.smInfo.n2InfoContent.ngapIeType argument with an unsupported or out-of-range value. The attack is remotely exploitable and requires sending a malformed message; no authentication is required. An attacker can cause the AMF process to crash, resulting in denial of service for mobile subscribers. The fix was released in version 2.8.0 (commit abf8a836564b966b5141110fc25ed413c4f17522) which replaces an assert_if_reached call with proper error handling.
Affected products
- Open5GS Open5GS up to 2.7.7
Timeline
- 2026-08-30: disclosed
- 2026-05-14: patched: Patch released in version 2.8.0