CVE-2026-1521
📋 TL;DR
A remote denial-of-service vulnerability exists in Open5GS SGWC component where manipulation of the sgwc_s5c_handle_bearer_resource_failure_indication function can crash the service. This affects all Open5GS deployments up to version 2.7.6 that have SGWC enabled. Attackers can exploit this remotely without authentication to disrupt 5G core network services.
💻 Affected Systems
- Open5GS
📦 What is this software?
Open5gs by Open5gs
⚠️ Risk & Real-World Impact
Worst Case
Complete SGWC service disruption causing 5G session management failures, affecting all connected user equipment in the network.
Likely Case
Targeted SGWC service crashes requiring manual restart, causing temporary service outages for affected network slices.
If Mitigated
Service remains available with proper network segmentation and monitoring detecting exploitation attempts.
🎯 Exploit Status
Exploit code has been publicly released and requires minimal technical skill to execute. The vulnerability is in a network-facing component.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in commit 69b53add90a9479d7960b822fc60601d659c328b and later versions
Vendor Advisory: https://github.com/open5gs/open5gs/issues/4268
Restart Required: Yes
Instructions:
1. Update Open5GS to latest version or apply commit 69b53add90a9479d7960b822fc60601d659c328b. 2. Rebuild from source if using source installation. 3. Restart SGWC service and all dependent services.
🔧 Temporary Workarounds
Network Segmentation
linuxRestrict access to SGWC service ports (typically 2123 for S5-C interface) to trusted network segments only.
iptables -A INPUT -p tcp --dport 2123 -s trusted_network -j ACCEPT
iptables -A INPUT -p tcp --dport 2123 -j DROP
🧯 If You Can't Patch
- Implement strict network access controls to limit SGWC S5-C interface exposure
- Deploy intrusion detection systems monitoring for abnormal SGWC traffic patterns
🔍 How to Verify
Check if Vulnerable:
Check Open5GS version: open5gs --version. If version is 2.7.6 or earlier, check if SGWC is running: systemctl status open5gs-sgwcCheck Version:
open5gs --versionVerify Fix Applied:
Verify commit hash includes 69b53add90a9479d7960b822fc60601d659c328b: git log --oneline | grep 69b53add📡 Detection & Monitoring
Log Indicators:
- SGWC service crashes or restarts
- Error logs mentioning sgwc_s5c_handle_bearer_resource_failure_indication
- Abnormal termination of sgwc process
Network Indicators:
- Unusual traffic patterns to SGWC S5-C port (2123)
- Multiple connection attempts from single source to SGWC
SIEM Query:
source="open5gs.log" AND ("sgwc crash" OR "segmentation fault" OR "bearer_resource_failure")🔗 References
- https://github.com/open5gs/open5gs/
- https://github.com/open5gs/open5gs/commit/69b53add90a9479d7960b822fc60601d659c328b
- https://github.com/open5gs/open5gs/issues/4268
- https://github.com/open5gs/open5gs/issues/4268#event-21989483261
- https://github.com/open5gs/open5gs/issues/4268#issue-3795012861
- https://vuldb.com/?ctiid.343192
- https://vuldb.com/?id.343192
- https://vuldb.com/?submit.738370
