CVE-2026-106807

A memory exhaustion issue exists in Open5GS v2.8.0 in the HTTP/2 SBI server. Repeated header names cause previously allocated header strings to be leaked, and HPACK compression allows an unauthenticated remote attacker to trigger tens of thousands of duplicate headers with a small request. Repeated crafted requests can cause persistent heap growth, exhaust process memory, and terminate the affected Open5GS network function, resulting in denial of service.

Open5GS through 2.8.0 contains a heap out-of-bounds read vulnerability in ogs_pfcp_parse_volume_measurement() in lib/pfcp/types.c. A remote unauthenticated attacker can send a PFCP Session Report Request to the SMF on UDP port 8805 with a short, all-flags Volume Measurement IE, reading up to 48 bytes and potentially crashing the SMF.

A vulnerability has been found in Open5GS up to 2.8.0 in the function smf_n4_handle_session_report_request of the file src/smf/n4-handler.c of the PFCP Session Report Request Handler component. The manipulation leads to a reachable assertion, and the attack may be initiated remotely.

Open5GS 2.6.1 through 2.8.0 contains an out-of-bounds read vulnerability in parse_scheme_output() in lib/sbi/conv.c during SUCI de-concealment due to incomplete length validation. Remote unauthenticated UEs or SBI peers can submit a crafted SUCI with a 42-byte scheme output to a UDM, triggering a heap over-read past the buffer.

Open5GS versions 1.3.0 through 2.8.0 contain a heap out-of-bounds write vulnerability in parse_multipart(). An unauthenticated attacker can corrupt memory by supplying an empty multipart boundary.

Open5GS through 2.8.0 contains a reachable assertion vulnerability in mme_gn_handle_sgsn_context_request() that allows remote unauthenticated attackers to crash the MME via malformed SGSN Address IEs. Attackers sending GTPv1-C traffic from a configured SGSN address with a known UE IMSI or P-TMSI can supply an invalid address length to terminate open5gs-mmed, denying service to all subscribers.

Open5GS through 2.8.0 contains a heap out-of-bounds read vulnerability in ogs_pfcp_parse_dropped_dl_traffic_threshold() that allows remote unauthenticated attackers to read past IE buffers via short IEs. Attackers can send PFCP Session Establishment or Modification Requests to the UPF on UDP port 8805 with DLPA and DLBY flags set, potentially crashing the UPF.

A weakness has been identified in Open5GS up to 2.7.7. This vulnerability affects the function ogs_pfcp_xact_local_create of the file src/upf/gtp-path.c of the component GTP-U Receive Path. This manipulation causes allocation of resources. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. Patch name: 9ffc252482d9b03ac01abcedbe95497ff4f95dd0. It is recommended to apply a patch to fix this issue.

A vulnerability was found in Open5GS up to 2.8.0 affecting the function ogs_pfcp_parse_volume_measurement in lib/pfcp/types.c of the PFCP Handler component. The manipulation results in a null pointer dereference. The attack may be launched remotely, and the patch is identified as 8f07b507b78ff94776f2cd49276eb116ed93d7f2.

A security flaw has been discovered in Open5GS up to 2.7.7 in the file lib/pfcp/handler.c of the PFCP Message Handler component. Manipulation leads to denial of service. Remote exploitation is possible, and the exploit has been publicly released. The patch is named 028e1dbb5e3271035ccee906ef417a97fc523f71.