CVE-2023-37004

Open5GS MME versions = 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send an Initial Context Setup Response message missing a required MMEUES1APID field to repeatedly crash the MME, resulting in denial of service...

CVE-2023-37016

Open5GS MME versions = 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send a UE Context Modification Response message missing a required MMEUES1APID field to repeatedly crash the MME, resulting in denial of service...

CVE-2023-37005

Open5GS MME <= 2.6.4 is affected by an assertion that can be remotely triggered via a malformed ASN.1 packet on the S1AP interface. An attacker can send an Initial Context Setup Failure message missing the required MME_UE_S1AP_ID field, which may repeatedly crash the MME and cause denial of se...

CVE-2023-37014

Open5GS MME versions ≤ 2.6.4 are affected by an assertion that can be remotely triggered via a malformed ASN.1 packet on the S1AP interface. An attacker can send a UE Context Release Request missing the required MME_UE_S1AP_ID field, causing the MME to repeatedly crash and resulting in a denial o...

CVE-2023-37002

Open5GS MME versions ≤ 2.6.4 are affected by an assertion triggered by a malformed ASN.1 packet on the S1AP interface. An attacker can send an E-RAB Modification Indication message missing the required MME_UE_S1AP_ID field to repeatedly crash the MME, causing denial of service. Affected product: ...

CVE-2023-37021

Open5GS MME version = 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send a UE Context Modification Failure message missing a required MMEUES1APID field to repeatedly crash the MME, resulting in denial of service...

CVE-2023-37017

Open5GS MME versions = 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send an S1Setup Request message missing a required Global eNB ID field to repeatedly crash the MME, resulting in denial of service...

CVE-2023-37016

Open5GS MME in versions

CVE-2023-37004

Open5GS MME versions = 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send an Initial Context Setup Response message missing a required MMEUES1APID field to repeatedly crash the MME, resulting in denial of service...

CVE-2023-37019

The CVE-2023-37019 issue affects Open5GS MME prior to 2.6.4. An assertion can be remotely triggered by a malformed ASN.1 packet on the S1AP interface, specifically by sending an S1Setup Request missing the required Supported TAs field. This can cause the MME to crash repeatedly, leading to Denial...

CVE-2023-37017

Affected software: Open5GS MME versions

CVE-2023-37014

Open5GS MME versions = 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send a UE Context Release Request message missing a required MMEUES1APID field to repeatedly crash the MME, resulting in denial of service...

CVE-2023-37009

Open5GS MME versions

CVE-2023-37020

Open5GS MME versions = 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send a UE Context Release Complete message missing a required MMEUES1APID field to repeatedly crash the MME, resulting in denial of service...

CVE-2023-37015

Open5GS MME versions = 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send a Path Switch Request message missing a required MMEUES1APID field to repeatedly crash the MME, resulting in denial of service...

CVE-2023-37019

Open5GS MME versions = 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send an S1Setup Request message missing a required Supported TAs field to repeatedly crash the MME, resulting in denial of service...

iperf: Denial of Service in iperf Due to Improper JSON Handling

A flaw was found in iperf. This vulnerability allows a Denial of Service DoS via the injection of malformed JSON data, which can result in a segmentation fault when a NULL pointer is passed to strdup...

GHSA-X5MQ-JJR3-VMX6 Missing validation of header name and value in codeigniter4/framework

Impact Lack of proper header validation for its name and value. The potential attacker can construct deliberately malformed headers with Header class. This could disrupt application functionality, potentially causing errors or generating invalid HTTP requests. In some cases, these malformed...

iperf: Denial of Service in iperf Due to Improper JSON Handling

A flaw was found in iperf. This vulnerability allows a Denial of Service DoS via the injection of malformed JSON data, which can result in a segmentation fault when a NULL pointer is passed to strdup...

golang: net: malformed DNS message can cause infinite loop

A flaw was found in the net package of the Go stdlib. When a malformed DNS message is received as a response to a query, the Lookup functions within the net package can get stuck in an infinite loop. This issue can lead to resource exhaustion and denial of service DoS conditions...