CVE-2026-106807
Received Received - Intake

Denial-of-Service in open5GS due to PFCP Resource Exhaustion

Publication date: 2026-11-02

Last updated on: 2026-11-02

Assigner: MITRE

Description
A denial-of-service vulnerability exists in open5GS v2.8.0 in the PFCP transaction handling path. When the PFCP transaction or timer resource pool is exhausted, ogs_pfcp_xact_remote_create() returns NULL, but the failure is not handled properly and leads to an ogs_assert(new) failure in ogs_pfcp_xact_receive(). An attacker able to send PFCP messages to the affected SMF/UPF can exhaust transaction resources and cause the network function process to terminate with SIGABRT, resulting in service disruption and preventing further session establishment until the affected component is restarted.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-02
Last Modified
2026-11-02
Generated
2026-11-02
AI Q&A
2026-11-02
EPSS Evaluated
N/A
NVD
CVE-2026-106807

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
n/a n/a n/a

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-106807 is a denial-of-service vulnerability in open5GS v2.8.0 affecting the PFCP transaction handling path. When transaction or timer resources are exhausted, the system fails to handle the error properly, causing an assertion failure that crashes the SMF or UPF process with SIGABRT. Attackers can exploit this by sending crafted PFCP messages to exhaust resources and disrupt service.

Detection Guidance

Monitor for crashes in SMF or UPF processes, particularly those handling PFCP messages on UDP port 8805. Check logs for SIGABRT signals or assertion failures in open5GS logs. Use network traffic analysis tools to detect abnormal PFCP message flooding targeting the affected components.

Impact Analysis

This vulnerability allows remote attackers to crash critical network functions (SMF or UPF) by sending specially crafted PFCP messages. This causes service disruption, prevents new session establishments, and requires manual restart of the affected component to restore functionality.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by causing service disruptions in network functions (SMF/UPF) that handle sensitive data. GDPR requires availability of personal data processing systems, while HIPAA mandates reliable access to protected health information systems. A denial-of-service condition that crashes these components may violate availability requirements in both regulations.

Mitigation Strategies

Upgrade open5GS to a patched version that includes commit d91af3b to handle transaction allocation failures gracefully. Implement rate limiting on PFCP endpoints to prevent resource exhaustion attacks. Restrict access to UDP/8805 to trusted sources only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-106807. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...