CVE-2026-91855
Received Received - Intake

Denial of Service in Open5GS PFCP Handler

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: VulDB

Description
A security flaw has been discovered in Open5GS up to 2.7.7. Affected by this vulnerability is an unknown functionality of the file lib/pfcp/handler.c of the component PFCP Message Handler. Performing a manipulation results in denial of service. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The patch is named 028e1dbb5e3271035ccee906ef417a97fc523f71. Applying a patch is the recommended action to fix this issue. CVE-2025-29339 describes a different assertion failure vulnerability in Open5GS UPF.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-91855
EUVD
EUVD-2026-78929

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
open5gs open5gs to 2.7.7 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-404 The product does not release or incorrectly releases a resource before it is made available for re-use.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-91855 is a critical vulnerability in Open5GS UPF version 2.7.7 where the process crashes after processing a specific sequence of malformed PFCP messages. The crash occurs due to a state leak during a failed GTP-U peer setup, not the malformed messages themselves. The issue involves four PFCP messages: an Association Setup Request, two Session Establishment Requests with malformed Outer Header Creation fields, and a Session Deletion Request. The UPF terminates with a fatal error 'Unknown family(0)' in the PFCP context.

Detection Guidance

Monitor Open5GS UPF logs for crashes with the error message 'Unknown family(0)' in the PFCP context. Check for sequences of malformed PFCP messages: Association Setup Request, two Session Establishment Requests with invalid Outer Header Creation fields, and a Session Deletion Request. Use network traffic analysis tools like Wireshark to inspect PFCP message sequences for these patterns.

Impact Analysis

This vulnerability can cause the Open5GS UPF process to terminate unexpectedly, disrupting network operations. It may lead to denial of service as the UPF crashes after processing specific malformed PFCP messages. The attack is remote and does not require specific eNodeB/gNodeB or UE models to trigger.

Mitigation Strategies

Apply the patch 028e1dbb5e3271035ccee906ef417a97fc523f71 to Open5GS UPF version 2.7.7. Update the PFCP message handler to validate Outer Header Creation IEs strictly. Ensure only supported GTP-U/IPv4, IPv6, or dual-stack variants are processed. Monitor UPF processes for unexpected terminations and restart them if crashes occur.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-91855. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart