CVE-2026-7585
Denial of Service in Open5GS AMF Component
Publication date: 2026-05-01
Last updated on: 2026-05-05
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| open5gs | open5gs | to 2.7.7 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-404 | The product does not release or incorrectly releases a resource before it is made available for re-use. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Open5GS up to version 2.7.7, specifically in the function amf_nudm_sdm_handle_provisioned within the AMF component. It allows an attacker to remotely manipulate the function, which can lead to a denial of service condition.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring the AMF component of Open5GS for crashes or abnormal termination, specifically exit code 134, which indicates an assertion failure caused by a buffer overflow in handling the defaultSingleNssais list.
Detection can involve capturing and analyzing 5G registration procedures where the AMF retrieves subscriber data from the UDM. Look for unusually large defaultSingleNssais lists in the nudm-sdm am-data responses.
While no specific commands are provided in the resources, you can use standard Linux commands to monitor the Open5GS AMF process logs and status, such as:
- journalctl -u open5gs-amf.service -f # To follow AMF service logs in real-time
- ps aux | grep open5gs-amf # To check if the AMF process is running
- grep -i 'assertion failed' /var/log/open5gs/amf.log # To find assertion failure messages
Additionally, network packet capture tools like tcpdump or Wireshark can be used to inspect the 5G registration messages for oversized defaultSingleNssais lists.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include monitoring and restricting the size of the defaultSingleNssais list returned by the UDM to the AMF to ensure it does not exceed the maximum allowed entries (8).
Since the vulnerability arises from a buffer overflow due to lack of bounds checking, applying any available patches or updates from the Open5GS project that address this issue is critical.
If no patch is available yet, consider implementing network-level protections to filter or block malicious UE registration attempts that send oversized defaultSingleNssais lists.
Also, monitor the AMF process for crashes and restart it promptly to minimize service disruption.
How can this vulnerability impact me? :
The impact of this vulnerability is a denial of service, meaning that an attacker can remotely cause the affected system to become unavailable or stop functioning properly.