CVE-2026-8730

Vulnerability

A flaw exists in Open5GS up to version 2.7.6, specifically in the NRF component's function ogs_sbi_nf_instance_set_id in /lib/sbi/context.c. When handling a PUT request to /nnrf-nfm/v1/nf-instances, the code does not verify that the nfInstanceId path component is present before calling the setter, which asserts a non-NULL pointer. This leads to an assertion failure and process abort [1].

Exploitation

An attacker can exploit this remotely by sending a PUT request to the NRF endpoint without the required {nfInstanceId} in the URL path. No authentication is required. The attack can be performed using a simple curl command: curl --http2-prior-knowledge -X PUT http:///nnrf-nfm/v1/nf-instances. The NRF process crashes immediately upon receiving the request [1].

Impact

Successful exploitation causes the NRF process to terminate with a fatal assertion error (exit code 139), resulting in a denial of service. The NRF is a critical component in the 5G core network; its unavailability disrupts network function registration and discovery, affecting overall network operations [1].

Mitigation

As of the publication date, no official fix has been released. The project was informed via issue report but has not responded. The vulnerability affects Open5GS up to version 2.7.6. Users should monitor the repository for patches or consider implementing input validation to reject requests missing the required path component [1] [2].