CVE-2026-2523 - Vulnerability Details

- Open5GS SMF gn-handler.c smf_gn_handle_create_pdp_context_request assertion

Description

A vulnerability was detected in Open5GS up to 2.7.6. The affected element is the function smf_gn_handle_create_pdp_context_request of the file /src/smf/gn-handler.c of the component SMF. The manipulation results in reachable assertion. It is possible to launch the attack remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Published: 2026-02-16

Score: 6.9 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A malformed Create PDP Context request triggers a reachable assertion in the Open5GS SMF component, causing the SMF process to crash. The flaw results from insufficient verification of the request data, aligned with CWE‑617, and leads to a denial of service for the SMF service.

Affected Systems

The vulnerability is present in all Open5GS releases up to and including version 2.7.6. It affects the SMF’s smf_gn_handle_create_pdp_context_request function located in gn-handler.c. Any deployment of Open5GS 2.7.6 or earlier is impacted, while newer releases are not documented to contain this issue.

Risk and Exploitability

The CVSS score of 6.9 indicates a medium severity flaw, and the EPSS score of less than 1 % suggests that exploitation is currently infrequent. The flaw is not listed in the CISA KEV catalogue, implying no confirmed active exploitation at the time of analysis. The publicly available exploit demonstrates that the assertion can be triggered remotely through the SMF interface, providing attackers the opportunity to bring the service down without local privileges.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

n/a

Open5GS

affected

Version	Status	Constraints
`2.7.0`	affected	—
`2.7.1`	affected	—
`2.7.2`	affected	—
`2.7.3`	affected	—
`2.7.4`	affected	—
`2.7.5`	affected	—
`2.7.6`	affected	—

Configuration 1 [-]

cpe:2.3:a:open5gs:open5gs:*:*:*:*:*:*:*:*

No data.

Vendor Product Confidence Versions

Open5gs

—

Version	Status	Scheme	Platform
`2.7.0`	affected	semver	—
`2.7.1`	affected	semver	—
`2.7.2`	affected	semver	—
`2.7.3`	affected	semver	—
`2.7.4`	affected	semver	—
`2.7.5`	affected	semver	—
`2.7.6`	affected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade to the latest Open5GS release that contains a fix for the assertion.
If an immediate upgrade is not feasible, restrict external access to the SMF interfaces using firewall rules or by placing the SMF behind a VPN to limit exposure to malformed requests.
Enable logging of SMF crashes and monitor logs for assertion failure messages; consider adding intrusion detection rules for anomalous SMF traffic.

Generated by OpenCVE AI on April 18, 2026 at 18:00 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact None

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.00113.

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/open5gs/open5gs/
https://github.com/open5gs/open5gs/issues/4285
https://github.com/open5gs/open5gs/issues/4285#issue-3809055236
https://vuldb.com/?ctiid.346111
https://vuldb.com/?id.346111
https://vuldb.com/?submit.738342

History

Wed, 18 Feb 2026 19:15:00 +0000

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:open5gs:open5gs::::::::

Tue, 17 Feb 2026 18:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 16 Feb 2026 12:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Open5gs Open5gs open5gs
Vendors & Products		Open5gs Open5gs open5gs

Mon, 16 Feb 2026 01:00:00 +0000

Type	Values Removed	Values Added
Description		A vulnerability was detected in Open5GS up to 2.7.6. The affected element is the function smf_gn_handle_create_pdp_context_request of the file /src/smf/gn-handler.c of the component SMF. The manipulation results in reachable assertion. It is possible to launch the attack remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Title		Open5GS SMF gn-handler.c smf_gn_handle_create_pdp_context_request assertion
Weaknesses		CWE-617
References		https://github.com/open5gs/open5gs/ https://github.com/open5gs/open5gs/issues/4285 https://github.com/open5gs/open5gs/issues/4285#issue-3809055236 https://vuldb.com/?ctiid.346111 https://vuldb.com/?id.346111 https://vuldb.com/?submit.738342
Metrics		cvssV2_0 `{'score': 5, 'vector': 'AV:N/AC:L/Au:N/C:N/I:N/A:P/E:POC/RL:ND/RC:UR'}` cvssV3_0 `{'score': 5.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R'}` cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R'}` cvssV4_0 `{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P'}`

Subscriptions

Open5gs Open5gs

MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2026-02-16T00:02:07.539Z

Updated: 2026-02-23T10:02:59.705Z

Reserved: 2026-02-15T08:39:59.010Z

Link: CVE-2026-2523

Vulnrichment

Updated: 2026-02-17T17:15:23.224Z

NVD

Status : Analyzed

Published: 2026-02-16T01:15:53.767

Modified: 2026-02-18T19:07:48.960

Link: CVE-2026-2523

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-04-18T18:15:06Z

Weaknesses

CWE-617

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact None

Availability Impact Partial

Exploitation poc

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object