Executive brief
Open5GS is the core network component for 5G and LTE networks, handling mobile network operations and quality-of-service settings. A remote attacker can trigger a program crash (denial of service) by sending malformed quality-of-service rules with invalid preemption capacity values, causing the network service to become unavailable.
Technical details
The vulnerability is a reachable assertion in the smf_nudm_sdm_handle_get function within Open5GS's Session Management Function (SMF) component. The root cause is insufficient validation of the preemptCap argument when parsing QoS rules and flow descriptions in NAS message handling. An unauthenticated remote attacker can send a specially crafted PDU Session Modification Request with malformed QoS payloads to trigger an assertion failure that crashes the SMF process. The fix validates QoS rules and flow descriptions at parse time in src/nas before they reach SMF logic, preventing malformed structures from reaching the vulnerable code path. Patched in version 2.8.0 (commit 4554405).
Affected products
- Open5GS Open5GS up to 2.7.7
Timeline
- 2026-08-30: disclosed
- 2026-08-30: patched: version 2.8.0