CVE-2026-78186
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
A flaw was found in Open5GS up to version 2.8.0 in an unknown function of src/hss/hss-cx-path.c in the HSS component. Manipulation of the User-Name argument causes a reachable assertion. The attack can be carried out remotely, and the exploit has been published.
Risk Assessment
A remote attack can cause service disruption (crash) by triggering an assertion. The organization is at risk of system unavailability.
Recommendation
Apply the patch named c9abe09421eb99bbf1cd7862a3d375e58a4eb9e4 to fix the vulnerability.
Other vulnerabilities in Open5GS
See all- CVE-2026-30045Unknown
An integer overflow in the /nnrf-disc/v1/nf-instances component of open5gs v2.7.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted HTTP/2 GET request.
- CVE-2026-37198High
An integer overflow in the SMF component of Open5GS v2.7.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted GTP packet.
- CVE-2026-30047High
A reachable assertion vulnerability in the /nsmf-pdusession/v1/sm-contexts component of Open5GS v2.7.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted DELETE request.
- CVE-2026-30046High
A reachable assertion vulnerability in the NUDM-UECM interface of Open5GS v2.7.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted DELETE request.
- CVE-2026-78158Medium
A flaw has been found in Open5GS 2.8.0 in the unknown code of the AMF UEContextReleaseRequest Path Handler component. Executing a manipulation can lead to improper authorization. The attack can be launched remotely.
- CVE-2026-78157High
A vulnerability was detected in Open5GS 2.8.0 in the pcrf_rx_aar_cb function of src/pcrf/pcrf-rx-path.c in the Rx AA-Request Handler component. Manipulation leads to an out-of-bounds read. The attack can be initiated remotely.
- CVE-2026-78156High
A security vulnerability was detected in Open5GS 2.8.0 in the hss_ogs_diam_s6a_air_cb function of src/hss/hss-s6a-path.c in the S6a Authentication-Information-Request Handler component. Manipulation of the Visited-PLMN-Id argument leads to a heap-based buffer overflow. The attack may be performed remotely.
- CVE-2026-71676High
Buffer overflow vulnerability in Open5GS v.2.7.0 allows a remote attacker to cause a denial of service via the NAS 5GS decoder chain, triggered when the message type byte of a NAS PDU is mutated.
- CVE-2026-71675High
An issue in Open5GS v.2.7.0 allows a remote attacker to cause a denial of service via the ngap_send_to_nas() function in src/amf/ngap-path.c.
- CVE-2025-15687Medium
A security flaw in Open5GS up to 2.7.6 affects the smf_gx_cca_cb function of the SMF Diameter Gx Credit-Control-Answer Handler, leading to denial of service. The attack can be launched remotely, and the exploit has been publicly released.
Original NVD description (English source)
A flaw has been found in Open5GS up to 2.8.0. This affects an unknown function of the file src/hss/hss-cx-path.c of the component HSS. This manipulation of the argument User-Name causes reachable assertion. The attack is possible to be carried out remotely. The exploit has been published and may be used. Patch name: c9abe09421eb99bbf1cd7862a3d375e58a4eb9e4. It is recommended to apply a patch to fix this issue.