Executive brief
Open5GS is an open-source implementation of 5G and LTE core network functions. A vulnerability in the Network Repository Function (NRF) component allows a remote attacker to crash the service by sending a specifically crafted network request. This results in a denial of service, potentially disrupting mobile network connectivity and management operations.
Technical details
A denial of service vulnerability exists in the Open5GS Network Repository Function (NRF) due to improper handling of the nfInstanceId argument in the ogs_sbi_nf_instance_set_id function within /lib/sbi/context.c. When a remote attacker sends a PUT request to the /nnrf-nfm/v1/nf-instances endpoint without providing the required {nfInstanceId} path component, the application fails to validate the presence of the ID before passing it to a setter function. This triggers a NULL pointer assertion (ogs_assert(id)), causing the NRF process to abort and exit (SIGSEGV/exit code 139). The attack can be performed remotely, though some CVSS metrics suggest low-privileged access may be required depending on the network deployment. As of the advisory date, the project has been informed but a formal patch has not been confirmed.
Affected products
- Open5GS Open5GS up to 2.7.6
Timeline
- 2026-04-20: disclosed: Issue reported on GitHub
- 2026-05-17: advisory: VulDB and NVD publication