Executive brief
Open5GS is an open-source implementation of 5G core network infrastructure. A vulnerability in the PFCP Session Report Request handler causes the service to crash (assertion failure) when it receives a malformed network request. An attacker on the network can trigger this crash remotely, disrupting 5G core network operations and causing service unavailability.
Technical details
The vulnerability is a reachable assertion failure in the smf_n4_handle_session_report_request function in src/smf/n4-handler.c. When a malformed PFCP Session Report Request is received, the handler incorrectly treats it as a session release request, leading to an assertion failure during session deletion. The issue affects PFCP (Packet Forwarding Control Protocol) processing in the Session Management Function (SMF) component. The attack is network-reachable and requires no authentication. An attacker can send a specially crafted PFCP message to trigger the assertion and cause a denial of service. The vulnerability is fixed in commit e5f0c06d0f2d9613b003daa1cfa3ba8a4bd157e9, which separates PFCP error handling from session release logic.
Affected products
- Open5GS Open5GS up to 2.8.0
Timeline
- 2026-09-16: disclosed
- 2026-08-31: patched: Patch commit e5f0c06d0f2d9613b003daa1cfa3ba8a4bd157e9