CVE-2026-37198

CVE-2026-37198 is an integer overflow in the SMF (Session Management Function) component of Open5GS v2.7.6 , an open-source 5G core network implementation. The flaw can be triggered by supplying a crafted GTP packet , allowing an unauthenticated, network-based attacker to cause a Denial of Servic...

CVE-2026-30046

Open5GS v2.7.6 is affected by a reachable assertion vulnerability in the NUDM-UECM interface . A remote, unauthenticated attacker can trigger a Denial of Service by supplying a crafted DELETE request , leading to a crash of the affected component. The CVSS v3.1 score is 7.5 (HIGH) , reflecting a ...

CVE-2026-30046

A reachable assertion vulnerability in the NUDM-UECM interface of Open5GS v2.7.6 allows attackers to cause a Denial of Service DoS via supplying a crafted DELETE request...

CVE-2026-30045

open5gs v2.7.6 is affected by an integer overflow in the /nnrf-disc/v1/nf-instances component, allowing a remote unauthenticated attacker to trigger a Denial of Service by supplying a crafted HTTP/2 GET request . The CVSS 3.1 score is 7.5 (HIGH) with network vector, low complexity, no privileges ...

CVE-2026-30045

An integer overflow in the /nnrf-disc/v1/nf-instances component of open5gs v2.7.6 allows attackers to cause a Denial of Service DoS via supplying a crafted HTTP/2 GET request...

CVE-2026-37198

An integer overflow in the SMF component of Open5GS v2.7.6 allows attackers to cause a Denial of Service DoS via supplying a crafted GTP packet...

CVE-2026-30047

Open5GS v2.7.6 contains a reachable assertion vulnerability in the /nsmf-pdusession/v1/sm-contexts REST endpoint. An unauthenticated, network-based attacker can trigger a Denial of Service by sending a crafted DELETE request to that component, resulting in a process crash due to the reachable ass...

CVE-2026-78186

A flaw has been found in Open5GS up to 2.8.0. This affects an unknown function of the file src/hss/hss-cx-path.c of the component HSS. This manipulation of the argument User-Name causes reachable assertion. The attack is possible to be carried out remotely. The exploit has been published and may ...

CVE-2026-78186 Open5GS HSS hss-cx-path.c assertion

A flaw has been found in Open5GS up to 2.8.0. This affects an unknown function of the file src/hss/hss-cx-path.c of the component HSS. This manipulation of the argument User-Name causes reachable assertion. The attack is possible to be carried out remotely. The exploit has been published and may ...

CVE-2026-78186 Open5GS HSS hss-cx-path.c assertion

A flaw has been found in Open5GS up to 2.8.0. This affects an unknown function of the file src/hss/hss-cx-path.c of the component HSS. This manipulation of the argument User-Name causes reachable assertion. The attack is possible to be carried out remotely. The exploit has been published and may ...

EUVD-2026-64722

A flaw has been found in Open5GS up to 2.8.0. This affects an unknown function of the file src/hss/hss-cx-path.c of the component HSS. This manipulation of the argument User-Name causes reachable assertion. The attack is possible to be carried out remotely. The exploit has been published and may ...

CVE-2026-78186

A remote reachable assertion vulnerability exists in the HSS component of Open5GS up to version 2.8.0, specifically in the file src/hss/hss-cx-path.c. The flaw is triggered by manipulation of the User-Name argument, leading to an assertion failure that impacts availability . The attack requires l...

CVE-2026-78157

A vulnerability was detected in Open5GS 2.8.0. This affects the function pcrfrxaarcb of the file src/pcrf/pcrf-rx-path.c of the component Rx AA-Request Handler. Performing a manipulation results in out-of-bounds read. It is possible to initiate the attack remotely. The patch is named...

CVE-2026-78158

A flaw has been found in Open5GS 2.8.0. This vulnerability affects unknown code of the component AMF UEContextReleaseRequest Path Handler. Executing a manipulation can lead to improper authorization. It is possible to launch the attack remotely...

EUVD-2026-64674

A security vulnerability has been detected in Open5GS 2.8.0. Affected by this issue is the function hssogsdiams6aaircb of the file src/hss/hss-s6a-path.c of the component S6a Authentication-Information-Request Handler. Such manipulation of the argument Visited-PLMN-Id leads to heap-based buffer...

CVE-2026-78156

A security vulnerability has been detected in Open5GS 2.8.0. Affected by this issue is the function hssogsdiams6aaircb of the file src/hss/hss-s6a-path.c of the component S6a Authentication-Information-Request Handler. Such manipulation of the argument Visited-PLMN-Id leads to heap-based buffer...

EUVD-2026-64676

A flaw has been found in Open5GS 2.8.0. This vulnerability affects unknown code of the component AMF UEContextReleaseRequest Path Handler. Executing a manipulation can lead to improper authorization. It is possible to launch the attack remotely...

CVE-2026-78158

Open5GS 2.8.0 contains an improper authorization flaw in the AMF UEContextReleaseRequest Path Handler . The root cause is not further specified in the provided documents. A remote attacker with low privileges can exploit this to bypass authorization controls, resulting in low impact on confidenti...

CVE-2026-78158 Open5GS AMF UEContextReleaseRequest Path improper authorization

A flaw has been found in Open5GS 2.8.0. This vulnerability affects unknown code of the component AMF UEContextReleaseRequest Path Handler. Executing a manipulation can lead to improper authorization. It is possible to launch the attack remotely...

CVE-2026-78158 Open5GS AMF UEContextReleaseRequest Path improper authorization

A flaw has been found in Open5GS 2.8.0. This vulnerability affects unknown code of the component AMF UEContextReleaseRequest Path Handler. Executing a manipulation can lead to improper authorization. It is possible to launch the attack remotely...