CVE-2026-8187
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk47th percentile - higher than 47% of all known CVEs
Summary
In Open5GS up to version 2.7.7, there is a vulnerability in the _gtpv1_u_recv_cb function of src/upf/gtp-path.c in the UPF component. Manipulation leads to resource exhaustion. The attack can be performed remotely. The project has not responded to the report.
Risk Assessment
A remote attacker can cause resource exhaustion (CPU/memory) on the UPF server, leading to denial of service for the 5G network.
Recommendation
Monitor for a patch from the vendor. Consider temporarily restricting access to the UPF interface or applying firewall rules.
Original NVD description (English source)
A flaw has been found in Open5GS up to 2.7.7. This impacts the function _gtpv1_u_recv_cb of the file src/upf/gtp-path.c of the component UPF. Executing a manipulation can lead to resource consumption. The attack may be performed from remote. The project was informed of the problem early through an issue report but has not responded yet.