Executive brief
Open5GS is an open-source implementation of 5G and LTE mobile core networks. A vulnerability in the Network Repository Function (NRF) component allows a remote user to crash the service by sending a series of valid subscription requests. This results in a denial of service, potentially disrupting mobile network connectivity for users relying on the affected core network.
Technical details
A resource exhaustion vulnerability exists in the Open5GS Network Repository Function (NRF) component due to improper handling of the SBI client pool. When processing 'POST /nnrf-nfm/v1/subscriptions' requests, the function 'ogs_sbi_client_add' in 'lib/sbi/client.c' attempts to allocate a new client from a fixed-size pool ('client_pool') if a matching client is not found. Because the 'client_pool' (default size 64) is significantly smaller than the subscription pool (default size 1024), an attacker can exhaust the client pool by providing unique notification URIs in repeated requests. This exhaustion triggers an 'ogs_assert' failure, leading to an immediate process abort and denial of service. The vulnerability is reachable remotely by any authenticated network function or actor capable of reaching the NRF SBI interface.
Affected products
- Open5GS Open5GS up to 2.7.7
Timeline
- 2026-04-20: disclosed: Issue reported on GitHub
- 2026-05-17: advisory: CVE published by VulDB/NVD