CVE-2026-30046

Deferred Deferred - Pending Action

Reachable Assertion in Open5GS NUDM-UECM Causes DoS

Publication date: 2026-08-27

Last updated on: 2026-08-31

Assigner: MITRE

Description

A reachable assertion vulnerability in the NUDM-UECM interface of Open5GS v2.7.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted DELETE request.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-08-31

Generated

2026-09-16

AI Q&A

2026-08-27

EPSS Evaluated

2026-09-15

NVD

CVE-2026-30046

EUVD

EUVD-2026-67103

Affected Vendors & Products

Vendor	Product	Version / Range
open5gs	open5gs	2.7.6

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-617	The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

Attack-Flow Graph

Executive Summary

CVE-2026-30046 is a Denial of Service vulnerability in Open5GS v2.7.6 affecting the NUDM-UECM interface. It occurs when a DELETE request without the required pduSessionId parameter triggers a reachable assertion failure in the udm_state_operational function, causing the UDM process to crash and disrupt service.

Detection Guidance

Monitor Open5GS UDM logs for crashes or abrupt terminations, particularly when DELETE requests are processed. Check for assertion failures in udm_state_operational function logs. Use network traffic analysis tools to inspect DELETE requests targeting the NUDM-UECM interface for missing pduSessionId parameters.

Impact Analysis

This vulnerability can cause service disruption by crashing the UDM process in Open5GS, leading to downtime for network services relying on this component. Attackers could exploit it by sending malformed DELETE requests to trigger the crash.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA. It causes a Denial of Service (DoS) by crashing the UDM component in Open5GS, disrupting service availability. Compliance impacts would depend on how the DoS affects data processing or availability in regulated environments.

Mitigation Strategies

Upgrade Open5GS to a patched version where the issue is fixed. Implement input validation to reject DELETE requests without pduSessionId. Configure UDM to handle malformed requests gracefully with HTTP 400 responses instead of crashing.

Hi! I’m here to help you understand CVE-2026-30046. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70