# CVE-2026-82589: Open5GS denial of service in N1-N2 message handler

Source: https://junglewise.ai/threats/cve-2026-82589-open5gs-denial-of-service-in-n1-n2-message-handler  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-30. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-82589 · Severity: medium · CVSS 4.3 · Published 2026-08-30

Open5GS is an open-source 5G core network implementation that processes mobile network signaling messages. A vulnerability in the N1-N2 message handler allows a remote attacker to crash the AMF (Access and Mobility Management Function) component by sending a specially crafted message with an unsupported parameter value, causing a denial of service that disrupts mobile network operations.

Technologies: [Open5GS](https://junglewise.ai/threats/technologies/open5gs). Vendors: [Open5GS](https://junglewise.ai/threats/vendors/open5gs).

## Quick answers

**Is CVE-2026-82589 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-82589 being exploited in the wild.

**How severe is CVE-2026-82589?** Medium severity, with a CVSS score of 4.3, published 30 August 2026.

**Which products and versions are affected?** Open5GS up to 2.7.7.

**Is there a fix for CVE-2026-82589?** A patch was published on 2026-05-14: Patch released in version 2.8.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-82589 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-82589?** Check whether you run Open5GS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a null pointer dereference or crash vulnerability in the amf_namf_comm_handle_n1_n2_message_transfer function within src/amf/namf-handler.c. The vulnerability exists in the N1-N2 Message Handler component and is triggered by manipulating the N1N2MessageTransferReqData.n2InfoContainer.smInfo.n2InfoContent.ngapIeType argument with an unsupported or out-of-range value. The attack is remotely exploitable and requires sending a malformed message; no authentication is required. An attacker can cause the AMF process to crash, resulting in denial of service for mobile subscribers. The fix was released in version 2.8.0 (commit abf8a836564b966b5141110fc25ed413c4f17522) which replaces an assert_if_reached call with proper error handling.

## Affected products

- Open5GS Open5GS up to 2.7.7

## Timeline

- 2026-08-30: disclosed
- 2026-05-14: patched: Patch released in version 2.8.0

## References

- [https://github.com/open5gs/open5gs/](https://github.com/open5gs/open5gs/)
- [https://github.com/open5gs/open5gs/commit/abf8a836564b966b5141110fc25ed413c4f17522](https://github.com/open5gs/open5gs/commit/abf8a836564b966b5141110fc25ed413c4f17522)

## Related threats

- [Open5GS HTTP/2 SBI server memory exhaustion](https://junglewise.ai/threats/cve-2026-106806-a-memory-exhaustion-issue-exists-in-open5gs-v2-8-0-in-the-http-2)
- [open5GS PFCP transaction handling denial of service](https://junglewise.ai/threats/cve-2026-106807-a-denial-of-service-vulnerability-exists-in-open5gs-v2-8-0-in)
- [Open5GS heap out-of-bounds write in multipart parsing](https://junglewise.ai/threats/cve-2026-116543-open5gs-1-3-0-through-2-8-0-contains-a-heap-out-of-bounds-write)
- [Open5GS assertion failure in SGSN context request handling](https://junglewise.ai/threats/cve-2026-108105-open5gs-through-2-8-0-contains-a-reachable-assertion)
- [Open5GS heap out-of-bounds read in PFCP parsing](https://junglewise.ai/threats/cve-2026-108103-open5gs-through-2-8-0-contains-a-heap-out-of-bounds-read)