CVE-2026-106806

A memory exhaustion issue exists in Open5GS v2.8.0 in the HTTP/2 SBI server. Repeated header names cause previously allocated header strings to be leaked, and HPACK compression allows an unauthenticated remote attacker to trigger tens of thousands of duplicate headers with a small request. Repeat...

CVE-2026-106807

A denial-of-service vulnerability exists in open5GS v2.8.0 in the PFCP transaction handling path. When the PFCP transaction or timer resource pool is exhausted, ogspfcpxactremotecreate returns NULL, but the failure is not handled properly and leads to an ogsassertnew failure in ogspfcpxactreceive...

CVE-2026-106806

A memory exhaustion issue exists in Open5GS v2.8.0 in the HTTP/2 SBI server. Repeated header names cause previously allocated header strings to be leaked, and HPACK compression allows an unauthenticated remote attacker to trigger tens of thousands of duplicate headers with a small request. Repeat...

EUVD-2026-115347

A denial-of-service vulnerability exists in open5GS v2.8.0 in the PFCP transaction handling path. When the PFCP transaction or timer resource pool is exhausted, ogspfcpxactremotecreate returns NULL, but the failure is not handled properly and leads to an ogsassertnew failure in ogspfcpxactreceive...

PT-2026-135503

A denial-of-service vulnerability exists in open5GS v2.8.0 in the PFCP transaction handling path. When the PFCP transaction or timer resource pool is exhausted, ogs pfcp xact remote create returns NULL, but the failure is not handled properly and leads to an ogs assertnew failure in ogs pfcp xact...

CVE-2026-106807: n/a: A denial-of-service vulnerability exists in open5GS v2.8.0 in the PFCP transaction handling path

A denial-of-service vulnerability exists in open5GS v2.8.0 in the PFCP transaction handling path. When the PFCP transaction or timer resource pool is exhausted, ogspfcpxactremotecreate returns NULL, but the failure is not handled properly and leads to an ogsassertnew failure in ogspfcpxactreceive...

EUVD-2026-115352

A memory exhaustion issue exists in Open5GS v2.8.0 in the HTTP/2 SBI server. Repeated header names cause previously allocated header strings to be leaked, and HPACK compression allows an unauthenticated remote attacker to trigger tens of thousands of duplicate headers with a small request. Repeat...

PT-2026-135543

A memory exhaustion issue exists in Open5GS v2.8.0 in the HTTP/2 SBI server. Repeated header names cause previously allocated header strings to be leaked, and HPACK compression allows an unauthenticated remote attacker to trigger tens of thousands of duplicate headers with a small request. Repeat...

CVE-2026-106807

A denial-of-service vulnerability exists in open5GS v2.8.0 in the PFCP transaction handling path. When the PFCP transaction or timer resource pool is exhausted, ogspfcpxactremotecreate returns NULL, but the failure is not handled properly and leads to an ogsassertnew failure in ogspfcpxactreceive...

CVE-2026-106807

A denial-of-service vulnerability exists in open5GS v2.8.0 in the PFCP transaction handling path. When the PFCP transaction or timer resource pool is exhausted, ogspfcpxactremotecreate returns NULL, but the failure is not handled properly and leads to an ogsassertnew failure in ogspfcpxactreceive...

CVE-2026-106806

A memory exhaustion vulnerability exists in Open5GS v2.8.0 within the HTTP/2 SBI server . The issue is caused by the leakage of previously allocated header strings when repeated header names are used; HPACK compression allows an unauthenticated remote attacker to trigger tens of thousands of dupl...

CVE-2026-106806: n/a: A memory exhaustion issue exists in Open5GS v2.8.0 in the HTTP/2 SBI server

A memory exhaustion issue exists in Open5GS v2.8.0 in the HTTP/2 SBI server. Repeated header names cause previously allocated header strings to be leaked, and HPACK compression allows an unauthenticated remote attacker to trigger tens of thousands of duplicate headers with a small request. Repeat...

CVE-2026-106807

A denial-of-service vulnerability exists in open5GS v2.8.0 within the PFCP transaction handling path . The root cause is improper error handling in ogs_pfcp_xact_remote_create() ; when the PFCP transaction or timer resource pool is exhausted, the function returns NULL, triggering an ogs_assert(ne...

CVE-2026-106806

A memory exhaustion issue exists in Open5GS v2.8.0 in the HTTP/2 SBI server. Repeated header names cause previously allocated header strings to be leaked, and HPACK compression allows an unauthenticated remote attacker to trigger tens of thousands of duplicate headers with a small request. Repeat...

CVE-2024-51179

CVE-2024-51179 : Flooding of Crafted packets from an Attacker can crash UPF/SMF in Open5gs Vulnerability Description Description: An issue in Open 5GS v.2.7.1 allows a remote attacker to cause a denial of servie via the Network Function Virtualizations NFVs such as the User Plane Function UPF and...

Open5GS-CVE-2025-41067-CVE-2025-41068-PoC

Open5GS NRF Denial of Service CVE-2025-41067 & CVE-2025-41068 This repository contains Proof-of-Concept PoC exploit scripts for two high-severity vulnerabilities discovered in NewPlane's Open5GS. These vulnerabilities can be triggered by an attacker to cause a Denial of Service DoS in the NRF...

CVE-2026-116544

Open5GS 2.6.1 through 2.8.0 contains an out-of-bounds read vulnerability in parseschemeoutput in lib/sbi/conv.c during SUCI de-concealment due to incomplete length validation. Remote unauthenticated UEs or SBI peers can submit a crafted SUCI with a 42-byte scheme output to a UDM, triggering a hea...

CVE-2026-116543

Open5GS 1.3.0 through 2.8.0 contains a heap out-of-bounds write vulnerability in parsemultipart that allows unauthenticated attackers to corrupt memory by supplying an empty multipart boundary. Attackers can send a single crafted multipart/related request to the SBI interface of any network...

EUVD-2026-109914

Open5GS 2.6.1 through 2.8.0 contains an out-of-bounds read vulnerability in parseschemeoutput in lib/sbi/conv.c during SUCI de-concealment due to incomplete length validation. Remote unauthenticated UEs or SBI peers can submit a crafted SUCI with a 42-byte scheme output to a UDM, triggering a hea...

CVE-2026-116544 Open5GS 2.6.1 through 2.8.0 Out-of-Bounds Read via parse_scheme_output

Open5GS 2.6.1 through 2.8.0 contains an out-of-bounds read vulnerability in parseschemeoutput in lib/sbi/conv.c during SUCI de-concealment due to incomplete length validation. Remote unauthenticated UEs or SBI peers can submit a crafted SUCI with a 42-byte scheme output to a UDM, triggering a hea...