Executive brief
Open5GS is an open-source implementation of 5G Core and EPC mobile network functions. A vulnerability in its Network Repository Function (NRF) component allows a remote attacker to crash the service by sending specially crafted requests that exhaust internal memory pools. This results in a denial of service, potentially disrupting mobile network operations and connectivity for users.
Technical details
A resource exhaustion vulnerability exists in Open5GS up to version 2.7.7 within the NRF component. The functions ogs_sbi_subscription_data_add and ogs_sbi_nf_service_add in /lib/sbi/context.c utilize fixed-size memory pools (subscription_data_pool and nf_service_pool). When these pools are exhausted—for example, by repeated POST requests to create subscriptions or PUT requests with oversized NFProfile.nfServices arrays—the application triggers an ogs_assert() failure, causing the NRF process to abort. Attackers can trigger this remotely via the Nnrf_NFManagement or Nnrf_NFDiscovery services. A patch (commit 819db11) remediates this by replacing assertions with error propagation, allowing the system to reject oversized requests while remaining operational.
Affected products
- Open5GS Open5GS up to 2.7.7
Timeline
- 2026-04-20: disclosed: Initial bug report for subscription pool exhaustion (Issue #4465)
- 2026-05-14: patched: Fix committed to main branch (819db11)
- 2026-05-17: advisory: CVE-2026-8744 published
References
- https://github.com/open5gs/open5gs/
- https://github.com/open5gs/open5gs/commit/819db11a08b9736a3576c4f99ceb28f7eb99523a
- https://github.com/open5gs/open5gs/issues/4465
- https://github.com/open5gs/open5gs/issues/4466
- https://github.com/open5gs/open5gs/pull/4534
- https://vuldb.com/submit/817029
- https://vuldb.com/submit/817030