562 matches found
CVE-2024-51179
CVE-2024-51179 : Flooding of Crafted packets from an Attacker can crash UPF/SMF in Open5gs Vulnerability Description Description: An issue in Open 5GS v.2.7.1 allows a remote attacker to cause a denial of servie via the Network Function Virtualizations NFVs such as the User Plane Function UPF and...
CVE-2026-108102 Open5GS through 2.8.0 Heap Out-of-Bounds Read via PFCP Volume Measurement IE
Open5GS through 2.8.0 contains a heap out-of-bounds read vulnerability in ogspfcpparsevolumemeasurement in lib/pfcp/types.c that allows remote unauthenticated attackers to read past IE buffers. Attackers can send a PFCP Session Report Request to the SMF on UDP port 8805 with a short, all-flags...
CVE-2026-108102 Open5GS through 2.8.0 Heap Out-of-Bounds Read via PFCP Volume Measurement IE
Open5GS through 2.8.0 contains a heap out-of-bounds read vulnerability in ogspfcpparsevolumemeasurement in lib/pfcp/types.c that allows remote unauthenticated attackers to read past IE buffers. Attackers can send a PFCP Session Report Request to the SMF on UDP port 8805 with a short, all-flags...
CVE-2026-108102
The Open5GS project (versions through 2.8.0 ) contains a heap out-of-bounds read vulnerability within the ogs_pfcp_parse_volume_measurement() function in lib/pfcp/types.c. This flaw allows remote unauthenticated attackers to read past Information Element (IE) buffers by sending a PFCP Session Rep...
EUVD-2026-95793
Open5GS through 2.8.0 contains a heap out-of-bounds read vulnerability in ogspfcpparsevolumemeasurement in lib/pfcp/types.c that allows remote unauthenticated attackers to read past IE buffers. Attackers can send a PFCP Session Report Request to the SMF on UDP port 8805 with a short, all-flags...
CVE-2026-108102: Out-of-bounds Read
Open5GS through 2.8.0 contains a heap out-of-bounds read vulnerability in ogspfcpparsevolumemeasurement in lib/pfcp/types.c that allows remote unauthenticated attackers to read past IE buffers. Attackers can send a PFCP Session Report Request to the SMF on UDP port 8805 with a short, all-flags...
PT-2026-93876
Name of the Vulnerable Software and Affected Versions Open5GS versions prior to 2.8.1 Description A remote attack can be initiated against the PFCP Session Report Request Handler component. The issue resides in the smf n4 handle session report request function within the src/smf/n4-handler.c file...
EUVD-2026-68293
A weakness has been identified in Open5GS up to 2.7.7. The affected element is the function smfnudmsdmhandleget of the file src/smf/nudm-handler.c of the component SMF. Executing a manipulation of the argument preemptCap can lead to reachable assertion. The attack may be launched remotely...
CVE-2026-82590
A weakness has been identified in Open5GS up to 2.7.7. The affected element is the function smfnudmsdmhandleget of the file src/smf/nudm-handler.c of the component SMF. Executing a manipulation of the argument preemptCap can lead to reachable assertion. The attack may be launched remotely...
CVE-2026-82590
Open5GS versions up to 2.7.7 are affected by a vulnerability in the SMF (Session Management Function) component, specifically in the function smf_nudm_sdm_handle_get within src/smf/nudm-handler.c. A remote attacker can manipulate the preemptCap argument to trigger a reachable assertion , resultin...
CVE-2026-82590 Open5GS SMF nudm-handler.c smf_nudm_sdm_handle_get assertion
A weakness has been identified in Open5GS up to 2.7.7. The affected element is the function smfnudmsdmhandleget of the file src/smf/nudm-handler.c of the component SMF. Executing a manipulation of the argument preemptCap can lead to reachable assertion. The attack may be launched remotely...
CVE-2026-82590
A weakness has been identified in Open5GS up to 2.7.7. The affected element is the function smfnudmsdmhandleget of the file src/smf/nudm-handler.c of the component SMF. Executing a manipulation of the argument preemptCap can lead to reachable assertion. The attack may be launched remotely...
CVE-2026-82590 Open5GS SMF nudm-handler.c smf_nudm_sdm_handle_get assertion
A weakness has been identified in Open5GS up to 2.7.7. The affected element is the function smfnudmsdmhandleget of the file src/smf/nudm-handler.c of the component SMF. Executing a manipulation of the argument preemptCap can lead to reachable assertion. The attack may be launched remotely...
CVE-2026-82590 Open5GS SMF nudm-handler.c smf_nudm_sdm_handle_get assertion
A weakness has been identified in Open5GS up to 2.7.7. The affected element is the function smfnudmsdmhandleget of the file src/smf/nudm-handler.c of the component SMF. Executing a manipulation of the argument preemptCap can lead to reachable assertion. The attack may be launched remotely...
CVE-2026-82590: Reachable Assertion
A weakness has been identified in Open5GS up to 2.7.7. The affected element is the function smfnudmsdmhandleget of the file src/smf/nudm-handler.c of the component SMF. Executing a manipulation of the argument preemptCap can lead to reachable assertion. The attack may be launched remotely...
PT-2026-83637
Name of the Vulnerable Software and Affected Versions Open5GS versions prior to 2.8.0 Description A weakness in the SMF component allows a remote attacker to cause a reachable assertion by manipulating the preemptCap argument within the smf nudm sdm handle get function located in the...
CVE-2026-37198
An integer overflow in the SMF component of Open5GS v2.7.6 allows attackers to cause a Denial of Service DoS via supplying a crafted GTP packet...
CVE-2026-37198: Integer Overflow or Wraparound
An integer overflow in the SMF component of Open5GS v2.7.6 allows attackers to cause a Denial of Service DoS via supplying a crafted GTP packet...