CVE-2026-2062
📋 TL;DR
This CVE describes a null pointer dereference vulnerability in Open5GS PGW S5U Address Handler that can cause denial of service. Attackers can remotely trigger this vulnerability to crash affected Open5GS instances. Organizations running Open5GS versions up to 2.7.6 are affected.
💻 Affected Systems
- Open5GS
📦 What is this software?
Open5gs by Open5gs
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption of the affected Open5GS instance, causing loss of 5G core network functionality for connected devices.
Likely Case
Service crash requiring manual restart of the Open5GS component, leading to temporary service interruption.
If Mitigated
No impact if patched or if workarounds prevent exploitation attempts.
🎯 Exploit Status
The exploit is publicly available and relatively simple to execute, making this vulnerability attractive to attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after commit f1bbd7b57f831e2a070780a7d8d5d4c73babdb59
Vendor Advisory: https://github.com/open5gs/open5gs/issues/4257
Restart Required: Yes
Instructions:
1. Update Open5GS to latest version or apply commit f1bbd7b57f831e2a070780a7d8d5d4c73babdb59
2. Restart Open5GS services
3. Verify the patch is applied by checking the version
🔧 Temporary Workarounds
Network Segmentation
linuxRestrict network access to Open5GS PGW components to trusted sources only
iptables -A INPUT -p tcp --dport [PGW_PORT] -s [TRUSTED_NETWORK] -j ACCEPT
iptables -A INPUT -p tcp --dport [PGW_PORT] -j DROP
🧯 If You Can't Patch
- Implement strict network access controls to limit exposure to the vulnerable PGW component
- Deploy monitoring and alerting for service crashes to enable rapid response to exploitation attempts
🔍 How to Verify
Check if Vulnerable:
Check Open5GS version: open5gs --version | grep '2.7.6' or earlierCheck Version:
open5gs --versionVerify Fix Applied:
Verify commit f1bbd7b57f831e2a070780a7d8d5d4c73babdb59 is present: git log --oneline | grep f1bbd7b57f831e2a070780a7d8d5d4c73babdb59📡 Detection & Monitoring
Log Indicators:
- Segmentation fault errors in Open5GS logs
- Unexpected PGW service termination
- Null pointer dereference error messages
Network Indicators:
- Unusual traffic patterns to PGW S5U interface
- Multiple connection attempts followed by service unavailability
SIEM Query:
source="open5gs.log" AND ("segmentation fault" OR "null pointer" OR "SIGSEGV")🔗 References
- https://github.com/open5gs/open5gs/
- https://github.com/open5gs/open5gs/commit/f1bbd7b57f831e2a070780a7d8d5d4c73babdb59
- https://github.com/open5gs/open5gs/issues/4257
- https://github.com/open5gs/open5gs/issues/4257#issue-3787701521
- https://vuldb.com/?ctiid.344622
- https://vuldb.com/?id.344622
- https://vuldb.com/?submit.744719
