Executive brief
Open5GS is an open-source implementation of 5G and LTE mobile core networks. A vulnerability in its Session Management Function (SMF) allows a remote attacker to crash the service by sending a specially crafted session creation request. This results in a denial of service, potentially disrupting mobile connectivity for users relying on the affected network core.
Technical details
A vulnerability in the SMF component of Open5GS (up to v2.7.7) leads to a denial of service via a service crash. The issue resides in the `smf_nsmf_handle_create_sm_context` function. When a `SmContextCreateData` request is received in Home-Routed (HR) roaming mode with a non-full Data Network Name (DNN), the system stores a null value for the full DNN. Subsequent processing triggers an `ogs_assert` failure in `smf_nsmf_pdusession_build_create_data` when attempting to build the request for the H-SMF. An attacker with the ability to send Nsmf_PDUSession requests can trigger this crash remotely. As of the advisory date, the project has been notified via an issue report but a formal patch has not been confirmed.
Affected products
- Open5GS Open5GS up to 2.7.7
Timeline
- 2026-04-20: disclosed: Issue reported on GitHub repository
- 2026-05-11: advisory: VulDB and NVD publication