VYPR
← All advisories
Low severity3.3NVD Advisory· Published Jan 2, 2026· Updated Apr 29, 2026

CVE-2025-15419

CVE-2025-15419

Description

A weakness has been identified in Open5GS up to 2.7.6. Affected by this issue is the function sgwc_s5c_handle_create_session_response of the file src/sgwc/s5c-handler.c of the component GTPv2-C Flow Handler. Executing a manipulation can lead to denial of service. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. This patch is called 5aaa09907e7b9e0a326265a5f08d56f54280b5f2. It is advisable to implement a patch to correct this issue.

Affected products

1
  • Open5gs/Open5gs
    cpe:2.3:a:open5gs:open5gs:*:*:*:*:*:*:*:*
    Range: <=2.7.6

Patches

1
5aaa09907e7b

sgwc: validate mandatory IEs and handle missing bearer context safely

https://github.com/open5gs/open5gsSukchan LeeDec 30, 2025via nvd-ref
commit
1 file changed · +14 −3
  • src/sgwc/s5c-handler.c+14 −3 modified
    @@ -228,21 +228,31 @@ void sgwc_s5c_handle_create_session_response(
         }
         if (rsp->bearer_contexts_created[i].eps_bearer_id.presence == 0) {
             ogs_error("No EPS Bearer ID");
-            break;
+            ogs_gtp_send_error_message(
+                    s11_xact, sgwc_ue ? sgwc_ue->mme_s11_teid : 0,
+                    OGS_GTP2_CREATE_SESSION_RESPONSE_TYPE,
+                    OGS_GTP2_CAUSE_MANDATORY_IE_MISSING);
+            return;
         }
         if (rsp->bearer_contexts_created[i].s5_s8_u_sgw_f_teid.presence == 0) {
             ogs_error("No GTP TEID");
-            break;
+            ogs_gtp_send_error_message(
+                    s11_xact, sgwc_ue ? sgwc_ue->mme_s11_teid : 0,
+                    OGS_GTP2_CREATE_SESSION_RESPONSE_TYPE,
+                    OGS_GTP2_CAUSE_MANDATORY_IE_MISSING);
+            return;
         }
 
         /* EPS Bearer ID */
         bearer = sgwc_bearer_find_by_sess_ebi(sess,
                     rsp->bearer_contexts_created[i].eps_bearer_id.u8);
         if (!bearer) {
+            ogs_error("No Bearer [%d]",
+                    rsp->bearer_contexts_created[i].eps_bearer_id.u8);
             ogs_gtp_send_error_message(
                     s11_xact, sgwc_ue ? sgwc_ue->mme_s11_teid : 0,
                     OGS_GTP2_CREATE_SESSION_RESPONSE_TYPE,
-                    OGS_GTP2_CAUSE_MANDATORY_IE_MISSING);
+                    OGS_GTP2_CAUSE_CONTEXT_NOT_FOUND);
             return;
         }
 
@@ -259,6 +269,7 @@ void sgwc_s5c_handle_create_session_response(
 
         rv = ogs_gtp2_f_teid_to_ip(pgw_s5u_teid, &ul_tunnel->remote_ip);
         if (rv != OGS_OK) {
+            ogs_error("ogs_gtp2_f_teid_to_ip() failed");
             ogs_gtp_send_error_message(
                     s11_xact, sgwc_ue ? sgwc_ue->mme_s11_teid : 0,
                     OGS_GTP2_CREATE_SESSION_RESPONSE_TYPE,

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

7

News mentions

0

No linked articles in our index yet.