Executive brief
Open5GS is an open-source implementation of 5G and 4G mobile core networks. A vulnerability in the Session Management Function (SMF) allows a connected mobile device to crash the core network service by sending a specially crafted session modification request. This results in a denial of service, preventing mobile users from maintaining or modifying their data connections.
Technical details
A denial of service vulnerability exists in the Open5GS Session Management Function (SMF) within the `gsm_handle_pdu_session_modification_qos_flow_descriptions` function in `src/smf/gsm-handler.c`. The issue stems from a lack of pre-validation for Quality of Service (QoS) flow parameters and bitrate units in NAS PDU Session Modification Requests. When an attacker sends a request with an out-of-range bitrate unit or an invalid number of parameters, the SMF triggers an `ogs_assert_if_reached()` or `ogs_fatal()` call in the underlying NAS library, leading to a process crash. A fix has been proposed in pull request #4513 which introduces a two-pass validation mechanism to ensure all parameters are valid before state mutation occurs.
Affected products
- Open5GS Open5GS up to 2.7.7
Timeline
- 2026-05-02: other: Fix pull request submitted to GitHub
- 2026-05-11: disclosed: Vulnerability publicly disclosed
- 2026-05-11: advisory: NVD published CVE-2026-8288