Executive brief
Open5GS is an open-source implementation of 5G and 4G mobile core networks. A vulnerability in its Network Repository Function (NRF) component allows a remote attacker to crash the service by sending a specially crafted network profile containing an excessive number of service entries. This results in a denial of service, potentially disrupting mobile network connectivity for users relying on the affected core network.
Technical details
A resource exhaustion vulnerability exists in the Open5GS NRF component, specifically within the 'ogs_nnrf_nfm_handle_nf_profile' function in 'lib/sbi/nnrf-handler.c'. The software uses fixed-size pools (nf_instance_pool and nf_service_pool) to manage Network Function profiles. When parsing incoming SBI (Service Based Interface) messages, such as NF registrations or discovery responses, the code uses 'ogs_assert()' to verify successful allocation from these pools. An attacker can provide a 'SearchResult' or 'NFProfile' containing more instances or services than the pool capacity (defaulting to 64 or 1024 respectively), triggering an assertion failure and immediate process termination (SIGABRT). This affects both the NRF during registration and other NFs (like AMF or SMF) when consuming discovery results. A patch has been proposed to replace the assertions with graceful truncation.
Affected products
- Open5GS Open5GS up to 2.7.7
Timeline
- 2026-04-20: disclosed: Issue first reported on GitHub
- 2026-05-07: patched: Pull request submitted to fix the assertion aborts
- 2026-05-11: advisory: CVE published