Executive brief
A denial-of-service vulnerability exists in Open5GS, an open-source implementation of 5G Core and EPC network functions. By sending a specially crafted request to the Session Management Function (SMF), a remote attacker can cause the service to crash. This disruption can lead to a loss of connectivity for mobile users and impact the overall availability of the cellular core network.
Technical details
A remote denial of service vulnerability exists in the Open5GS Session Management Function (SMF) up to version 2.7.7. The flaw is located in the `smf_nsmf_handle_update_data_in_vsmf` function within `src/smf/nsmf-handler.c`. The component fails to validate if a target session is a home-routed roaming session before processing a `vsmf-pdu-session` modify request. When a request is sent for a standard non-home-routed session, the `ngap_build_pdu_session_resource_modify_request_transfer` function fails to encode the ASN.1 PDU, resulting in a NULL buffer. This triggers a fatal assertion (`ogs_assert(param.n2smbuf)`), causing the SMF process to crash (SIGSEGV/exit code 139). An attacker with network access to the SBI (Service Based Interface) can exploit this remotely.
Affected products
- Open5GS Open5GS up to 2.7.7
Timeline
- 2026-04-20: disclosed: Issue reported on GitHub repository
- 2026-05-11: advisory: CVE published and NVD entry created