Reachable Assertion in Open5GS v2.7.6 Causes DoS

Executive Summary

CVE-2026-30047 is a reachable assertion vulnerability in Open5GS v2.7.6's SMF component. It occurs when processing a malformed HTTP/2 POST request to /nsmf-pdusession/v1/sm-contexts with a PDU session ID of 0. This triggers an assertion failure in the smf_sess_find_by_psi function, causing the SMF to crash due to a segmentation fault.

Useful 0 Not Useful 0

Detection Guidance

Monitor Open5GS SMF logs for crashes or assertion failures in the /nsmf-pdusession/v1/sm-contexts endpoint. Check for segmentation faults or errors related to smf_sess_find_by_psi in context.c. Use network traffic analysis tools to inspect HTTP/2 POST requests to the SMF API for malformed PDU session IDs, particularly with ID 0.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause a Denial of Service (DoS) by crashing the Open5GS SMF component. This disrupts service for connected User Equipment (UEs), leading to network outages or degraded performance for mobile data sessions.

Useful 0 Not Useful 0

Mitigation Strategies

Apply the latest Open5GS patch or update to version 2.7.7 or later. Implement input validation to reject PDU session IDs of 0 in the SMF component. Configure network firewalls to filter malformed HTTP/2 requests targeting the /nsmf-pdusession/v1/sm-contexts endpoint. Temporarily disable the affected API endpoint if an immediate patch is unavailable.

Useful 0 Not Useful 0