CVE-2026-82589

Received Received - Intake

Denial of Service in Open5GS due to N1-N2 Message Handler

Publication date: 2026-08-30

Last updated on: 2026-08-30

Assigner: VulDB

Description

A security flaw has been discovered in Open5GS up to 2.7.7. Impacted is the function amf_namf_comm_handle_n1_n2_message_transfer of the file src/amf/namf-handler.c of the component N1-N2 Message Handler. Performing a manipulation of the argument N1N2MessageTransferReqData.n2InfoContainer.smInfo.n2InfoContent.ngapIeType results in denial of service. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 2.8.0 is recommended to address this issue. The patch is named abf8a836564b966b5141110fc25ed413c4f17522. It is advisable to upgrade the affected component.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-30

Last Modified

2026-08-30

Generated

2026-08-31

AI Q&A

2026-08-31

EPSS Evaluated

N/A

NVD

CVE-2026-82589

Affected Vendors & Products

Vendor	Product	Version / Range
open5gs	open5gs	to 2.7.7 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-404	The product does not release or incorrectly releases a resource before it is made available for re-use.

Attack-Flow Graph

Executive Summary

This vulnerability is a denial of service flaw in Open5GS versions up to 2.7.7. It exists in the N1-N2 Message Handler component, specifically in the function amf_namf_comm_handle_n1_n2_message_transfer. An attacker can remotely manipulate the argument N1N2MessageTransferReqData.n2InfoContainer.smInfo.n2InfoContent.ngapIeType to cause a system crash or service disruption.

Detection Guidance

Detection of CVE-2026-82589 requires monitoring for abnormal behavior in Open5GS versions up to 2.7.7, particularly in the N1-N2 Message Handler component. Check logs for crashes or errors in src/amf/namf-handler.c related to N1N2MessageTransferReqData.n2InfoContainer.smInfo.n2InfoContent.ngapIeType manipulation. Verify Open5GS version with command: open5gs version. If version is <=2.7.7, the system is vulnerable.

Impact Analysis

If exploited, this vulnerability could lead to a denial of service, causing the Open5GS service to become unavailable. This may disrupt network operations, especially in environments relying on Open5GS for communication services. The public availability of an exploit increases the risk of real-world attacks.

Compliance Impact

This vulnerability causes a denial of service due to improper handling of N1N2 message transfers in Open5GS. While it does not directly expose data, availability issues could impact systems handling regulated data under GDPR or HIPAA, potentially leading to compliance violations if services are disrupted.

Mitigation Strategies

Upgrade Open5GS to version 2.8.0 or later to address the vulnerability. The patch is named abf8a836564b966b5141110fc25ed413c4f17522.

Hi! I’m here to help you understand CVE-2026-82589. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70