Executive brief
Open5GS is an open-source implementation of 5G and LTE core network functions. A vulnerability in the Session Management Function (SMF) component allows a remote attacker to crash the service, leading to a denial of service. This could disrupt mobile network connectivity for users relying on the affected core network infrastructure.
Technical details
A denial of service vulnerability exists in the Open5GS Session Management Function (SMF) component within the gsm_build_pdu_session_establishment_accept function in /src/smf/gsm-build.c. The issue is triggered when the SMF processes a '201 Created' response from an H-SMF containing invalid base64 encoded data in the qosFlowsSetupList[*].qosRules field. An attacker with low privileges can exploit this remotely via the network to cause a service crash (CWE-404). As of the advisory date, the project has been informed but a formal patch has not been confirmed, though a public exploit/PoC is available.
Affected products
- Open5GS Open5GS up to 2.7.7
Timeline
- 2026-05-11: disclosed: Initial disclosure via VulDB and NVD
- 2026-05-11: advisory
- 2026-05-11: other: Public exploit/PoC became available