CVE-2026-7587
Denial of Service in Open5GS
Publication date: 2026-05-01
Last updated on: 2026-05-07
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| open5gs | open5gs | to 2.7.7 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-404 | The product does not release or incorrectly releases a resource before it is made available for re-use. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Open5GS up to version 2.7.7, specifically in the function amf_nsmf_pdusession_handle_update_sm_context within the AMF component. It allows an attacker to remotely manipulate this function, which leads to a denial of service condition.
How can this vulnerability impact me? :
The vulnerability can be exploited remotely to cause a denial of service, potentially disrupting the availability of the affected Open5GS service.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring the behavior of the Open5GS AMF component, specifically looking for crashes or assertion failures in the amf_nsmf_pdusession_handle_update_sm_context() function.
Detection involves checking for abnormal termination of the AMF process or logs indicating assertion failures related to invalid AMF transaction states when processing SMF /modify responses containing n2SmInfoType=PDU_RES_SETUP_REQ.
You can use system commands to monitor the Open5GS AMF process status and logs, for example:
- Use journalctl or systemctl to check for AMF crashes: `journalctl -u open5gs-amf -f` or `systemctl status open5gs-amf`
- Check Open5GS log files for assertion failures or crash messages related to nsmf-handler.c around lines 364-365.
- Use network packet capture tools like tcpdump or Wireshark to monitor and analyze the SMF /modify responses containing n2SmInfoType=PDU_RES_SETUP_REQ to identify malformed or unexpected messages triggering the crash.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting or validating the SMF peers that can send /modify responses to the AMF to prevent untrusted or malformed messages from triggering the vulnerability.
Since the vulnerability causes a denial of service via a crash, monitoring and restarting the AMF process automatically can reduce downtime.
Additionally, applying any available patches or updates from the Open5GS project once they are released is critical, although as of now the project has not responded to the issue report.
In the meantime, consider implementing network-level controls such as firewall rules or access control lists to limit communication to trusted SMF nodes only.