CVE-2026-7586
Denial of Service in Open5GS due to AMF Component
Publication date: 2026-05-01
Last updated on: 2026-05-01
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| open5gs | open5gs | to 2.7.7 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-404 | The product does not release or incorrectly releases a resource before it is made available for re-use. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a weakness in the Open5GS software, specifically in the function ogs_id_get_value within the file /src/amf/nudm-handler.c of the AMF component. It allows an attacker to cause a denial of service (DoS) condition by manipulating this function. The vulnerability can be exploited remotely, and the exploit code has been made publicly available.
How can this vulnerability impact me? :
The primary impact of this vulnerability is a denial of service, which means that an attacker could disrupt the normal operation of the affected Open5GS component. This could lead to service outages or degraded performance, potentially affecting users relying on the system.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability causes the AMF component of Open5GS to crash during a UE registration flow when processing a malformed GPSI string in the Nudm_SDM am-data response.
Detection can focus on monitoring the AMF process for unexpected crashes or exit code 134, which indicates an assertion failure triggered by the malformed GPSI.
Additionally, network traffic inspection can be used to identify malformed GPSI values, specifically GPSI strings that contain only "msisdn" without the required hyphen and second token (e.g., "msisdn-1234567890").
Suggested commands to detect this issue include:
- Use system logs or process monitoring tools to check for AMF crashes or restarts, for example: `journalctl -u open5gs-amf` or `systemctl status open5gs-amf`.
- Monitor for exit code 134 in AMF logs indicating assertion failure.
- Capture and inspect network traffic between AMF and UDM to identify malformed GPSI strings using tools like tcpdump or Wireshark, e.g., `tcpdump -i <interface> -A port <udm-port>` and filter for GPSI values.
- Search AMF logs for errors related to `ogs_id_get_value()` or nudm-handler.c assertion failures.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include preventing the AMF from processing malformed GPSI values that cause the crash.
Since the vulnerability is triggered by a malformed GPSI string lacking the required hyphen and second token, validating and sanitizing GPSI inputs before processing can help mitigate the issue.
If possible, restrict or monitor the UDM responses to ensure they do not contain malformed GPSI values.
Additionally, monitor the AMF service for crashes and implement automatic restarts to reduce downtime.
Consider applying any patches or updates from the Open5GS project once available, as the project has been informed but has not yet responded.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.