Open5GS: Four Vulnerabilities Disclosed, Including High-Severity Use-After-Free
Open5GS users face risks from four newly disclosed vulnerabilities, including a high-severity use-after-free flaw, impacting PFCP and AMF components.
Key findings
- Four vulnerabilities disclosed for Open5GS between September 14-16, 2026.
- Vulnerabilities include denial of service, null pointer dereference, reachable assertion, and use-after-free.
- Affected components include PFCP Handler and AMF Nnrf Handler.
- High severity flaw CVE-2026-90707 affects versions up to 2.7.x.
- Medium severity flaws affect versions up to 2.8.0 and 2.7.7.
On September 14-16, 2026, a batch of four medium-to-high severity vulnerabilities was disclosed for Open5GS, a popular open-source 5G core network software. These vulnerabilities, affecting various components including the PFCP Handler and AMF Nnrf Handler, could lead to denial of service, null pointer dereference, reachable assertion, and use-after-free conditions. The disclosures highlight potential weaknesses in the handling of PFCP messages and network function discovery mechanisms within Open5GS.
The vulnerabilities span across different functional areas within Open5GS. CVE-2026-92417, a medium severity flaw (CVSSv3 6.5), resides in the ogs_pfcp_parse_volume_measurement function within lib/pfcp/types.c. This vulnerability can result in a null pointer dereference and is remotely exploitable. Another medium severity issue, CVE-2026-92416 (CVSSv3 4.3), impacts the smf_n4_handle_session_report_request function in src/smf/n4-handler.c, leading to a reachable assertion.
Furthermore, CVE-2026-91855, a medium severity vulnerability (CVSSv3 5.3), affects an unspecified functionality in lib/pfcp/handler.c and can cause a denial of service. This flaw was found in Open5GS versions up to 2.7.7. The most severe vulnerability in this batch is CVE-2026-90707, rated high (CVSSv3 8.3). This flaw is located in the amf_nnrf_try_amf_discovery_fallback function within src/amf/nnrf-handler.c and can lead to a use-after-free condition due to manipulation of the discovery_option argument. This vulnerability affects Open5GS versions up to 2.7.x.
The affected versions for the disclosed vulnerabilities are up to 2.8.0 for CVE-2026-92417 and CVE-2026-92416, up to 2.7.7 for CVE-2026-91855, and up to 2.7.x for CVE-2026-90707. Patches have been identified for some of these issues, including a specific commit hash 8f07b507b78ff94776f2cd49276eb for CVE-2026-92417. Users of Open5GS are advised to update to patched versions as soon as possible to mitigate the risks associated with these vulnerabilities. The remote exploitability of these flaws underscores the importance of timely security updates for network infrastructure.
This batch of vulnerabilities serves as a reminder for Open5GS users to maintain up-to-date systems and to monitor for future security advisories. The diverse nature of the flaws, ranging from denial of service to memory corruption, highlights the need for comprehensive security testing and patching strategies within the Open5GS ecosystem.