Open5GS-CVE-2025-41067-CVE-2025-41068-PoC

Open5GS NRF Denial of Service CVE-2025-41067 & CVE-2025-41068 This repository contains Proof-of-Concept PoC exploit scripts for two high-severity vulnerabilities discovered in NewPlane's Open5GS. These vulnerabilities can be triggered by an attacker to cause a Denial of Service DoS in the NRF...

CVE-2024-51179

CVE-2024-51179 : Flooding of Crafted packets from an Attacker can crash UPF/SMF in Open5gs Vulnerability Description Description: An issue in Open 5GS v.2.7.1 allows a remote attacker to cause a denial of servie via the Network Function Virtualizations NFVs such as the User Plane Function UPF and...

CVE-2026-116544

Open5GS 2.6.1 through 2.8.0 contains an out-of-bounds read vulnerability in parseschemeoutput in lib/sbi/conv.c during SUCI de-concealment due to incomplete length validation. Remote unauthenticated UEs or SBI peers can submit a crafted SUCI with a 42-byte scheme output to a UDM, triggering a hea...

CVE-2026-116543

Open5GS 1.3.0 through 2.8.0 contains a heap out-of-bounds write vulnerability in parsemultipart that allows unauthenticated attackers to corrupt memory by supplying an empty multipart boundary. Attackers can send a single crafted multipart/related request to the SBI interface of any network...

EUVD-2026-109914

Open5GS 2.6.1 through 2.8.0 contains an out-of-bounds read vulnerability in parseschemeoutput in lib/sbi/conv.c during SUCI de-concealment due to incomplete length validation. Remote unauthenticated UEs or SBI peers can submit a crafted SUCI with a 42-byte scheme output to a UDM, triggering a hea...

CVE-2026-116544 Open5GS 2.6.1 through 2.8.0 Out-of-Bounds Read via parse_scheme_output

Open5GS 2.6.1 through 2.8.0 contains an out-of-bounds read vulnerability in parseschemeoutput in lib/sbi/conv.c during SUCI de-concealment due to incomplete length validation. Remote unauthenticated UEs or SBI peers can submit a crafted SUCI with a 42-byte scheme output to a UDM, triggering a hea...

CVE-2026-116544 Open5GS 2.6.1 through 2.8.0 Out-of-Bounds Read via parse_scheme_output

Open5GS 2.6.1 through 2.8.0 contains an out-of-bounds read vulnerability in parseschemeoutput in lib/sbi/conv.c during SUCI de-concealment due to incomplete length validation. Remote unauthenticated UEs or SBI peers can submit a crafted SUCI with a 42-byte scheme output to a UDM, triggering a hea...

CVE-2026-116543 Open5GS 1.3.0 through 2.8.0 Heap Out-of-Bounds Write via SBI Multipart Parser

Open5GS 1.3.0 through 2.8.0 contains a heap out-of-bounds write vulnerability in parsemultipart that allows unauthenticated attackers to corrupt memory by supplying an empty multipart boundary. Attackers can send a single crafted multipart/related request to the SBI interface of any network...

CVE-2026-116544

Open5GS versions 2.6.1 through 2.8.0 are vulnerable to an out-of-bounds read in the parse_scheme_output() function located in lib/sbi/conv.c. The vulnerability is caused by incomplete length validation during SUCI de-concealment. Remote unauthenticated UEs or SBI peers can exploit this by submitt...

EUVD-2026-109913

Open5GS 1.3.0 through 2.8.0 contains a heap out-of-bounds write vulnerability in parsemultipart that allows unauthenticated attackers to corrupt memory by supplying an empty multipart boundary. Attackers can send a single crafted multipart/related request to the SBI interface of any network...

CVE-2026-116544 Open5GS 2.6.1 through 2.8.0 Out-of-Bounds Read via parse_scheme_output

Open5GS 2.6.1 through 2.8.0 contains an out-of-bounds read vulnerability in parseschemeoutput in lib/sbi/conv.c during SUCI de-concealment due to incomplete length validation. Remote unauthenticated UEs or SBI peers can submit a crafted SUCI with a 42-byte scheme output to a UDM, triggering a hea...

CVE-2026-116543 Open5GS 1.3.0 through 2.8.0 Heap Out-of-Bounds Write via SBI Multipart Parser

Open5GS 1.3.0 through 2.8.0 contains a heap out-of-bounds write vulnerability in parsemultipart that allows unauthenticated attackers to corrupt memory by supplying an empty multipart boundary. Attackers can send a single crafted multipart/related request to the SBI interface of any network...

CVE-2026-116543

The Open5GS software (versions 1.3.0 through 2.8.0 ) is vulnerable to a heap out-of-bounds write in the parse_multipart() function. An unauthenticated attacker can cause memory corruption or a crash by sending a single crafted multipart/related request to the SBI interface of any network function...

PT-2026-123397

Open5GS 2.6.1 through 2.8.0 contains an out-of-bounds read vulnerability in parse scheme output in lib/sbi/conv.c during SUCI de-concealment due to incomplete length validation. Remote unauthenticated UEs or SBI peers can submit a crafted SUCI with a 42-byte scheme output to a UDM, triggering a...

PT-2026-123396

Open5GS 1.3.0 through 2.8.0 contains a heap out-of-bounds write vulnerability in parse multipart that allows unauthenticated attackers to corrupt memory by supplying an empty multipart boundary. Attackers can send a single crafted multipart/related request to the SBI interface of any network...

Security Evaluation of 6G-Oriented and O-RAN Networks through Targeted Attacks

The sixth generation 6G of networks is supported by increased bandwidth, automation through the use of O-RAN technologies. Simultaneously though autonomous operation leads to an extensive threat surface and sophisticated attacks. Understanding the attack impact, the Tactics, Techniques and...

CVE-2026-108103

Open5GS through 2.8.0 contains a heap out-of-bounds read vulnerability in ogspfcpparsedroppeddltrafficthreshold that allows remote unauthenticated attackers to read past IE buffers via short IEs. Attackers can send PFCP Session Establishment or Modification Requests to the UPF on UDP port 8805 wi...

CVE-2026-108105

Open5GS through 2.8.0 contains a reachable assertion vulnerability in mmegnhandlesgsncontextrequest that allows remote unauthenticated attackers to crash the MME via malformed SGSN Address IEs. Attackers sending GTPv1-C traffic from a configured SGSN address with a known UE IMSI or P-TMSI can...

CVE-2026-108102

Open5GS through 2.8.0 contains a heap out-of-bounds read vulnerability in ogspfcpparsevolumemeasurement in lib/pfcp/types.c that allows remote unauthenticated attackers to read past IE buffers. Attackers can send a PFCP Session Report Request to the SMF on UDP port 8805 with a short, all-flags...

CVE-2026-108105

Open5GS through 2.8.0 contains a reachable assertion vulnerability in mmegnhandlesgsncontextrequest that allows remote unauthenticated attackers to crash the MME via malformed SGSN Address IEs. Attackers sending GTPv1-C traffic from a configured SGSN address with a known UE IMSI or P-TMSI can...