CVE-2026-2523
📋 TL;DR
This vulnerability in Open5GS SMF component allows remote attackers to trigger a reachable assertion via manipulated PDP context requests, potentially causing denial of service. It affects Open5GS deployments up to version 2.7.6. The exploit is publicly available and can be launched remotely without authentication.
💻 Affected Systems
- Open5GS
📦 What is this software?
Open5gs by Open5gs
⚠️ Risk & Real-World Impact
Worst Case
Remote attackers can crash the SMF service, causing complete denial of service for 5G core network functions, potentially disrupting mobile network operations.
Likely Case
Service disruption through SMF crashes, requiring manual restart of affected components and temporary loss of session management capabilities.
If Mitigated
Limited impact with proper network segmentation and monitoring, allowing quick detection and recovery from service interruptions.
🎯 Exploit Status
Exploit details are publicly available in GitHub issues. Attack requires sending specially crafted PDP context requests to the SMF component.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: Not available
Restart Required: Yes
Instructions:
No official patch available. Monitor Open5GS GitHub repository for updates. When patch is released: 1. Update to patched version 2. Restart SMF service 3. Verify fix with test PDP context requests
🔧 Temporary Workarounds
Network Segmentation
linuxRestrict access to SMF component to trusted networks only
iptables -A INPUT -p tcp --dport [SMF_PORT] -s [TRUSTED_NETWORK] -j ACCEPT
iptables -A INPUT -p tcp --dport [SMF_PORT] -j DROP
Rate Limiting
linuxImplement rate limiting on PDP context requests to prevent mass exploitation
iptables -A INPUT -p tcp --dport [SMF_PORT] -m limit --limit 10/min --limit-burst 20 -j ACCEPT
🧯 If You Can't Patch
- Implement strict network access controls to limit SMF exposure
- Deploy monitoring and alerting for SMF service crashes or abnormal PDP context request patterns
🔍 How to Verify
Check if Vulnerable:
Check Open5GS version: open5gs --version. If version is 2.7.6 or earlier, system is vulnerable.Check Version:
open5gs --versionVerify Fix Applied:
When patch is available: 1. Update to patched version 2. Send test PDP context requests 3. Verify SMF service remains stable📡 Detection & Monitoring
Log Indicators:
- SMF service crashes
- Assertion failures in /src/smf/gn-handler.c
- Abnormal PDP context request patterns
Network Indicators:
- Unusual volume of PDP context requests from single sources
- Malformed GTP-C packets targeting SMF
SIEM Query:
source="open5gs" AND ("assertion" OR "crash" OR "gn-handler.c")