Executive brief
Open5GS is an open-source implementation of 5G and LTE core network functions. A vulnerability in the Network Repository Function (NRF) component allows a remote attacker to crash the service by sending a specially crafted web request. This results in a denial of service, potentially disrupting mobile network connectivity and discovery services.
Technical details
A NULL pointer dereference exists in the Open5GS Network Repository Function (NRF) component within the yuarel_parse function in /lib/sbi/conv.c. The vulnerability is triggered during inter-PLMN discovery fallback when an invalid 'hnrf-uri' query parameter is provided alongside 'target-plmn-list' and 'requester-plmn-list'. When parsing fails, the code attempts to log a member of an uninitialized request object, leading to a process crash (SIGSEGV). An attacker can exploit this by sending a crafted HTTP/2 GET request to the /nnrf-disc/v1/nf-instances endpoint. As of the advisory date, the issue remains unpatched in version 2.7.7.
Affected products
- Open5GS Open5GS up to 2.7.7
Timeline
- 2026-04-20: disclosed: Issue reported on GitHub repository
- 2026-05-11: advisory: CVE published by NVD/VulDB