Open5GS: Four DoS Vulnerabilities Disclosed Together in v2.7.6

Key findings

Four Denial of Service vulnerabilities disclosed for Open5GS v2.7.6 on August 27, 2026.
Two vulnerabilities are integer overflows, triggered by crafted GTP packets and HTTP/2 requests.
Two vulnerabilities are reachable assertions, exploitable via crafted DELETE requests.
All reported vulnerabilities affect Open5GS version 2.7.6.
The primary impact is the potential for service disruption and unavailability.

On August 27, 2026, a batch of four Denial of Service (DoS) vulnerabilities was disclosed for Open5GS, all affecting version 2.7.6. These vulnerabilities, discovered and reported on the same day, highlight potential weaknesses in the handling of network functions and packet processing within the 5G core network software. The disclosures collectively underscore the importance of robust input validation and error handling in network infrastructure software.

Three of the disclosed vulnerabilities stem from issues within specific network function components. CVE-2026-30047 and CVE-2026-30046, both rated High with a CVSSv3 score of 7.5, are described as reachable assertion vulnerabilities. CVE-2026-30047 affects the SMF PDU Session context, allowing for DoS via a crafted DELETE request. Similarly, CVE-2026-30046 impacts the NUDM-UECM interface, also exploitable through a crafted DELETE request. These assertion failures indicate that the software encounters unexpected states when processing specific requests, leading to a crash.

The remaining two vulnerabilities, CVE-2026-37198 and CVE-2026-30045, are attributed to integer overflow flaws. CVE-2026-37198 is located in the SMF component and can be triggered by a crafted GTP packet, leading to a DoS. CVE-2026-30045 resides in the NRF discovery component and can be exploited via a crafted HTTP/2 GET request, also resulting in a DoS. Integer overflows are a common class of vulnerability where arithmetic operations exceed the maximum value for an integer type, potentially leading to unexpected behavior or crashes.

All disclosed vulnerabilities affect Open5GS version 2.7.6. The disclosures do not specify if patches are immediately available, but users are advised to consult the official Open5GS advisories for the latest information on affected versions and remediation steps. Given the nature of these vulnerabilities, which allow for Denial of Service, prompt attention and patching are crucial for maintaining the availability and stability of Open5GS deployments.

The coordinated disclosure of these four DoS vulnerabilities on a single day emphasizes the need for continuous security auditing and timely patching of network core components. Users of Open5GS should prioritize updating to a version that addresses these issues once released and remain vigilant for any further security advisories from the vendor.

The batch of vulnerabilities includes:

CVE-2026-37198: Integer overflow in SMF component via crafted GTP packet.
CVE-2026-30047: Reachable assertion in SMF PDU Session context via crafted DELETE request.
CVE-2026-30046: Reachable assertion in NUDM-UECM interface via crafted DELETE request.
CVE-2026-30045: Integer overflow in NRF discovery component via crafted HTTP/2 GET request.

All reported issues affect Open5GS version 2.7.6 and result in a Denial of Service.

The vulnerabilities were disclosed on August 27, 2026.

The primary impact of these vulnerabilities is Denial of Service (DoS), affecting the availability of the Open5GS network functions.

Users should update to a patched version of Open5GS as soon as it becomes available.