Executive brief
Open5GS is an open-source implementation of 5G and LTE core network functions. A vulnerability in the Session Management Function (SMF) component can allow a remote attacker to crash the service, leading to a denial of service. This could disrupt mobile network connectivity and operations for users relying on the affected core network.
Technical details
A denial of service vulnerability exists in Open5GS versions up to 2.7.7 within the Session Management Function (SMF) component. The issue is rooted in the OpenAPI_list_create function, which fails to properly handle specific malformed responses. Specifically, the SMF crashes when receiving an H-SMF '201 Created' response that is missing the 'qosFlowsSetupList' field. An attacker with network access to the SMF can trigger this crash remotely, leading to an improper resource shutdown (CWE-404). While a public exploit/PoC has been disclosed, the project has not yet released an official patch at the time of this advisory.
Affected products
- Open5GS Open5GS up to 2.7.7
Timeline
- 2026-05-11: advisory: Initial disclosure by VulDB
- 2026-05-11: disclosed: Public exploit disclosed via GitHub issue 4449