Executive brief
Open5GS is an open-source implementation of 5G and LTE core network functions. A vulnerability in the Network Repository Function (NRF) component allows a remote user to crash the service by sending a specially crafted request. This results in a denial of service, potentially disrupting mobile network operations and connectivity for users.
Technical details
A denial of service vulnerability exists in the Open5GS Network Repository Function (NRF) due to improper handling of malformed JSON input. Specifically, the function 'ogs_sbi_discovery_option_parse_plmn_list' in '/lib/sbi/conv.c' fails to validate the results of JSON parsing before passing them to 'ogs_sbi_parse_plmn_list'. When a discovery query (GET /nnrf-disc/v1/nf-instances) contains a non-JSON string in the 'target-plmn-list' or 'requester-plmn-list' parameters, the application triggers a fatal assertion failure because the PLMN list object is NULL. An attacker with network access to the SBI interface can exploit this to remotely terminate the NRF process. As of the advisory date, the project has been notified but a formal patch has not been confirmed.
Affected products
- Open5GS Open5GS up to 2.7.7
Timeline
- 2026-04-20: disclosed: Issue reported on GitHub repository
- 2026-05-17: advisory: CVE published and detailed by VulDB/NVD