CVE-2024-51179

CVE-2024-51179 : 攻撃者からの細工されたパケットのフラッディングにより、Open5gs の UPF/SMF がクラッシュする可能性がある 脆弱性の説明 説明: Open 5GS v.2.7.1 には、リモートの攻撃者が User Plane Function（UPF）や Session Management Function（SMF）などの Network Function Virtualizations（NFV）を介してサービス拒否を引き起こすことを可能にする問題があります。NFV 内で発生するクラッシュにより、Packet Data...

CVE-2026-107166

A weakness has been identified in Open5GS up to 2.7.7. This vulnerability affects the function ogspfcpxactlocalcreate of the file src/upf/gtp-path.c of the component GTP-U Receive Path. This manipulation causes allocation of resources. The attack is possible to be carried out remotely. The exploi...

CVE-2026-107166 Open5GS GTP-U Receive Path gtp-path.c ogs_pfcp_xact_local_create allocation of resources

A weakness has been identified in Open5GS up to 2.7.7. This vulnerability affects the function ogspfcpxactlocalcreate of the file src/upf/gtp-path.c of the component GTP-U Receive Path. This manipulation causes allocation of resources. The attack is possible to be carried out remotely. The exploi...

EUVD-2026-94412

A weakness has been identified in Open5GS up to 2.7.7. This vulnerability affects the function ogspfcpxactlocalcreate of the file src/upf/gtp-path.c of the component GTP-U Receive Path. This manipulation causes allocation of resources. The attack is possible to be carried out remotely. The exploi...

CVE-2026-107166 Open5GS GTP-U Receive Path gtp-path.c ogs_pfcp_xact_local_create allocation of resources

A weakness has been identified in Open5GS up to 2.7.7. This vulnerability affects the function ogspfcpxactlocalcreate of the file src/upf/gtp-path.c of the component GTP-U Receive Path. This manipulation causes allocation of resources. The attack is possible to be carried out remotely. The exploi...

CVE-2026-107166 Open5GS GTP-U Receive Path gtp-path.c ogs_pfcp_xact_local_create allocation of resources

A weakness has been identified in Open5GS up to 2.7.7. This vulnerability affects the function ogspfcpxactlocalcreate of the file src/upf/gtp-path.c of the component GTP-U Receive Path. This manipulation causes allocation of resources. The attack is possible to be carried out remotely. The exploi...

CVE-2026-107166

The Open5GS software (versions up to 2.7.7 ) is vulnerable to a remote attack affecting the GTP-U Receive Path component. The flaw exists in the ogs_pfcp_xact_local_create function within the src/upf/gtp-path.c file, where a manipulation can lead to an allocation of resources (CWE-770, CWE-400). ...

PT-2026-107570

A weakness has been identified in Open5GS up to 2.7.7. This vulnerability affects the function ogs pfcp xact local create of the file src/upf/gtp-path.c of the component GTP-U Receive Path. This manipulation causes allocation of resources. The attack is possible to be carried out remotely. The...

Open5GS-CVE-2025-41067-CVE-2025-41068-PoC

Open5GS NRF サービス拒否 CVE-2025-41067 & CVE-2025-41068 このリポジトリには、NewPlaneのOpen5GSで発見された重大度の高い2つの脆弱性に対するProof-of-Concept PoC エクスプロイトスクリプトが含まれています。これらの脆弱性は、攻撃者によってトリガーされることで、NRF Network Repository Function コンポーネントにサービス拒否 DoS を引き起こす可能性があります。 脆弱性の詳細 CVEs: CVE-2025-41067, CVE-2025-41068 影響を受けるソフトウェア:...

open5gs:ipfw_rule_fuzz: Use-of-uninitialized-value in ogs_log_set_mask_level

Project: https://github.com/open5gs/open5gs.git Detailed Report: https://oss-fuzz.com/testcase?key=5982628881432576 Project: open5gs Fuzzing Engine: libFuzzer Fuzz Target: ipfwrulefuzz Job Type: libfuzzermsanopen5gs Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash...

CVE-2026-92417

A vulnerability was found in Open5GS up to 2.8.0. This affects the function ogspfcpparsevolumemeasurement in the library lib/pfcp/types.c of the component PFCP Handler. The manipulation results in null pointer dereference. The attack may be launched remotely. The patch is identified as...

CVE-2026-92416

A vulnerability has been found in Open5GS up to 2.8.0. Affected by this issue is the function smfn4handlesessionreportrequest of the file src/smf/n4-handler.c of the component PFCP Session Report Request Handler. The manipulation leads to reachable assertion. The attack may be initiated remotely...

CVE-2026-92417

CVE-2026-92417 is a null pointer dereference in Open5GS (up to version 2.8.0), located in the function ogs_pfcp_parse_volume_measurement within lib/pfcp/types.c of the PFCP Handler component. A remote attacker with low privileges can trigger the defect, resulting in a denial of service (high avai...

EUVD-2026-80936

A vulnerability was found in Open5GS up to 2.8.0. This affects the function ogspfcpparsevolumemeasurement in the library lib/pfcp/types.c of the component PFCP Handler. The manipulation results in null pointer dereference. The attack may be launched remotely. The patch is identified as...

CVE-2026-92417 Open5GS PFCP types.c ogs_pfcp_parse_volume_measurement null pointer dereference

A vulnerability was found in Open5GS up to 2.8.0. This affects the function ogspfcpparsevolumemeasurement in the library lib/pfcp/types.c of the component PFCP Handler. The manipulation results in null pointer dereference. The attack may be launched remotely. The patch is identified as...

CVE-2026-92417 Open5GS PFCP types.c ogs_pfcp_parse_volume_measurement null pointer dereference

A vulnerability was found in Open5GS up to 2.8.0. This affects the function ogspfcpparsevolumemeasurement in the library lib/pfcp/types.c of the component PFCP Handler. The manipulation results in null pointer dereference. The attack may be launched remotely. The patch is identified as...

CVE-2026-92417 Open5GS PFCP types.c ogs_pfcp_parse_volume_measurement null pointer dereference

A vulnerability was found in Open5GS up to 2.8.0. This affects the function ogspfcpparsevolumemeasurement in the library lib/pfcp/types.c of the component PFCP Handler. The manipulation results in null pointer dereference. The attack may be launched remotely. The patch is identified as...

CVE-2026-92416 Open5GS PFCP Session Report Request n4-handler.c smf_n4_handle_session_report_request assertion

A vulnerability has been found in Open5GS up to 2.8.0. Affected by this issue is the function smfn4handlesessionreportrequest of the file src/smf/n4-handler.c of the component PFCP Session Report Request Handler. The manipulation leads to reachable assertion. The attack may be initiated remotely...

CVE-2026-92416

CVE-2026-92416 affects Open5GS versions up to 2.8.0 . The vulnerable component is the PFCP Session Report Request Handler , specifically the function smf_n4_handle_session_report_request in src/smf/n4-handler.c. A remote attacker with low privileges can trigger a reachable assertion , leading to ...

CVE-2026-92416 Open5GS PFCP Session Report Request n4-handler.c smf_n4_handle_session_report_request assertion

A vulnerability has been found in Open5GS up to 2.8.0. Affected by this issue is the function smfn4handlesessionreportrequest of the file src/smf/n4-handler.c of the component PFCP Session Report Request Handler. The manipulation leads to reachable assertion. The attack may be initiated remotely...