Executive brief
Open5GS is an open-source implementation of 5G Core and EPC mobile network functions. A vulnerability in the Session Management Function (SMF) component allows a remote attacker to crash the service, leading to a denial of service. This could disrupt mobile network connectivity for users relying on the affected core network infrastructure.
Technical details
A denial of service vulnerability exists in the Open5GS Session Management Function (SMF) up to version 2.7.7. The flaw is located in the 'ogs_nas_parse_qos_rules' function and is triggered by improper handling of empty packet-filter content within 'n1SmMsg' QoS rules. An attacker can exploit this by sending a specially crafted 'POST' request to the '/nsmf-pdusession/v1/sm-contexts/{smContextRef}/modify' endpoint. Successful exploitation results in a crash of the SMF component. While the issue has been publicly disclosed in the project's issue tracker, a formal patch from the vendor was not confirmed at the time of the advisory.
Affected products
- Open5GS Open5GS up to 2.7.7
Timeline
- 2026-05-11: advisory: NVD/VulDB advisory published
- 2026-05-11: disclosed: Public disclosure of the vulnerability details and exploit potential