Executive brief
Open5GS is an open-source implementation of 5G and 4G mobile core networks. A vulnerability in its Network Repository Function (NRF) component allows a remote attacker to crash the service by sending a specially crafted network request. This results in a denial of service, potentially disrupting mobile network connectivity and management operations.
Technical details
A denial of service vulnerability exists in the Open5GS Network Repository Function (NRF) component due to improper resource handling in the SBI (Service Based Interface) message parsing library. Specifically, the function `ogs_sbi_discovery_option_add_service_names` in `/lib/sbi/message.c` contains an assertion that triggers a process abort when the `service-names` or `snssais` query parameters exceed the `OGS_SBI_MAX_NUM_OF_SERVICE_TYPE` limit. A remote attacker can exploit this by sending a crafted HTTP/2 GET request to the `/nnrf-disc/v1/nf-instances` endpoint. This causes the NRF process to exit with a fatal assertion failure (SIGABRT), leading to a complete service outage. As of the advisory date, the issue remains unpatched in version 2.7.7.
Affected products
- Open5GS Open5GS up to 2.7.7
Timeline
- 2026-04-20: disclosed: Issue reported on GitHub repository
- 2026-05-17: advisory: CVE published and added to NVD