Description
A vulnerability was found in Open5GS up to 2.7.1. This affects the function hss_ogs_diam_s6a_air_cb/hss_ogs_diam_s6a_ulr_cb of the file src/hss/hss-s6a-path.c of the component Diameter S6a Interface. Performing a manipulation of the argument os.len results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been made public and could be used. Upgrading to version 2.7.2 is able to mitigate this issue. The patch is named e89aa79efe629ae90f59dcdf8847c117d9a7da86. It is suggested to upgrade the affected component.
Published: 2026-08-11
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Open5GS version 2.7.1 and earlier contain a stack‑based buffer overflow in hss_ogs_diam_s6a_ulr_cb, the Diameter S6a interface callback. By manipulating the os.len argument in a Diameter message, an attacker can trigger the overflow, breaking the stack and potentially executing arbitrary code on the host. The flaw maps to CWE‑119 and CWE‑121 and would allow a remote attacker to compromise confidentiality, integrity, and availability of the HSS.

Affected Systems

The affected vendor is Open5GS and the vulnerable component is the Diameter S6a interface, specifically src/hss/hss‑s6a‑path.c. All releases up to and including 2.7.1 are affected; the bug is fixed in release 2.7.2.

Risk and Exploitability

The CVSS score of 5.3 places the vulnerability at moderate severity. An EPSS score below 1% indicates that exploitation is unlikely, but a public exploit exists and the flaw is remotely reachable. The vulnerability is not listed in the CISA KEV catalog. Because attackers can trigger the overflow with a crafted Diameter request, the practical risk remains significant and the flaw should be patched as soon as possible.

Generated by OpenCVE AI on August 12, 2026 at 20:10 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Open5GS deployment to release 2.7.2, which replaces the vulnerable code with bounds‑checked logic.
  • If an upgrade cannot be performed immediately, restrict the Diameter S6a service to a trusted internal network segment and block inbound traffic from untrusted sources.
  • In custom or legacy code paths, enforce strict input validation on the os.len field and ensure all buffers are sized and checked before use.

Generated by OpenCVE AI on August 12, 2026 at 20:10 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 12 Aug 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 11 Aug 2026 19:30:00 +0000

Type Values Removed Values Added
Description A vulnerability was found in Open5GS up to 2.7.1. This affects the function hss_ogs_diam_s6a_air_cb/hss_ogs_diam_s6a_ulr_cb of the file src/hss/hss-s6a-path.c of the component Diameter S6a Interface. Performing a manipulation of the argument os.len results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been made public and could be used. Upgrading to version 2.7.2 is able to mitigate this issue. The patch is named e89aa79efe629ae90f59dcdf8847c117d9a7da86. It is suggested to upgrade the affected component.
Title Open5GS Diameter S6a hss-s6a-path.c hss_ogs_diam_s6a_ulr_cb stack-based overflow
First Time appeared Open5gs
Open5gs open5gs
Weaknesses CWE-119
CWE-121
CPEs cpe:2.3:a:open5gs:open5gs:*:*:*:*:*:*:*:*
Vendors & Products Open5gs
Open5gs open5gs
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Open5gs Open5gs
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-12T16:58:14.188Z

Reserved: 2026-08-09T17:45:47.671Z

Link: CVE-2024-14042

cve-icon Vulnrichment

Updated: 2026-08-12T15:51:58.621Z

cve-icon NVD

Status : Deferred

Published: 2026-08-11T20:17:22.067

Modified: 2026-08-12T20:59:21.023

Link: CVE-2024-14042

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-12T20:15:03Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-121

    Stack-based Buffer Overflow