Executive brief
Open5GS is an open-source implementation of 5G and LTE core network functions. A vulnerability in the Session Management Function (SMF) component allows a remote attacker to crash the service by sending a specially crafted network request. This results in a denial of service, potentially disrupting mobile connectivity for users relying on the affected core network.
Technical details
A vulnerability exists in the SMF component of Open5GS within the `smf_nsmf_handle_update_data_in_vsmf` function in `src/smf/nsmf-handler.c`. The issue is caused by a null pointer dereference when processing a `POST` request to the `/nsmf-pdusession/v1/vsmf-pdu-session/{smContextRef}/modify` endpoint. Specifically, if a `qosFlowsAddModRequestList` item contains a `qfi` and `qosFlowDescription` but lacks a `qosFlowProfile`, the application attempts to log a validation error using fields from the missing profile. This results in a process crash (SIGSEGV). An attacker with network access to the SMF's SBI (Service Based Interface) can exploit this to cause a persistent denial of service. As of the advisory date, the project has been informed but a formal patch has not been confirmed.
Affected products
- Open5GS Open5GS up to 2.7.7
Timeline
- 2026-04-20: disclosed: Issue reported on GitHub repository
- 2026-05-11: advisory: CVE published and NVD entry created