Executive brief
Open5GS is an open-source implementation of 5G and LTE core network functions. A vulnerability in its Authentication Server Function (AUSF) component allows a remote attacker to crash the service by sending a burst of specific authentication requests. This results in a denial of service, potentially disrupting mobile network connectivity for users relying on the affected core network.
Technical details
A denial of service vulnerability exists in the Open5GS AUSF component due to improper resource management in the `ogs_timer_add` function within `src/ausf/nausf-handler.c`. An attacker with network access can send repeated bursts of `PUT` requests to the `5g-aka-confirmation` endpoint while a backend Unified Data Management (UDM) service is unresponsive. This causes outbound transactions and their associated timers to remain pending, eventually exhausting the timer pool. When the pool is exhausted, the application fails to allocate new timers, leading to an assertion failure and a fatal crash (SIGABRT). The vulnerability is present in versions up to 2.7.7.
Affected products
- Open5GS Open5GS up to 2.7.7
Timeline
- 2026-04-23: disclosed: Issue reported on GitHub repository
- 2026-05-17: advisory: CVE-2026-8745 published