Description
A vulnerability was identified in Open5GS up to 2.7.7. This issue affects some unknown processing of the file src/amf/namf-handler.c of the component Transfer Endpoint. Such manipulation leads to null pointer dereference. The attack can be launched remotely. Upgrading to version 2.8.0 is capable of addressing this issue. The name of the patch is abf8a836564b966b5141110fc25ed413c4f17522. Upgrading the affected component is advised.
Published: 2026-08-30
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A null pointer dereference in the Transfer Endpoint component of Open5GS's AMF (namf-handler.c) can be triggered remotely, potentially causing the application to crash and leading to a denial of service. This vulnerability corresponds to CWE-476 and CWE-404, indicating an uninitialized object use and a missing resource scenario.

Affected Systems

The vulnerability affects Open5GS deployments up to version 2.7.7. Upgrading to version 2.8.0 or later incorporates the patch commit abf8a836564b966b5141110fc25ed413c4f17522, which resolves the issue.

Risk and Exploitability

With a CVSS score of 5.3, the severity is moderate. No EPSS data is available, and the vulnerability is not listed in CISA KEV, suggesting a relatively low exploitation probability. However, the remote attack vector noted in the description means an attacker with network access to the AMF could trigger a crash, impacting availability for connected users.

Generated by OpenCVE AI on August 30, 2026 at 23:21 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Deploy the latest Open5GS release (v2.8.0 or newer) that contains the patch commit abf8a836564b966b5141110fc25ed413c4f17522.
  • If an immediate upgrade is impractical, isolate the AMF service from public networks and restrict inbound connections to trusted IPs to reduce exposure.
  • Implement application or network monitoring to detect unexpected crashes or abnormal traffic patterns that may indicate exploitation attempts.

Generated by OpenCVE AI on August 30, 2026 at 23:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 30 Aug 2026 22:15:00 +0000

Type Values Removed Values Added
Description A vulnerability was identified in Open5GS up to 2.7.7. This issue affects some unknown processing of the file src/amf/namf-handler.c of the component Transfer Endpoint. Such manipulation leads to null pointer dereference. The attack can be launched remotely. Upgrading to version 2.8.0 is capable of addressing this issue. The name of the patch is abf8a836564b966b5141110fc25ed413c4f17522. Upgrading the affected component is advised.
Title Open5GS Transfer Endpoint namf-handler.c null pointer dereference
First Time appeared Open5gs
Open5gs open5gs
Weaknesses CWE-404
CWE-476
CPEs cpe:2.3:a:open5gs:open5gs:*:*:*:*:*:*:*:*
Vendors & Products Open5gs
Open5gs open5gs
References
Metrics cvssV2_0

{'score': 4, 'vector': 'AV:N/AC:L/Au:S/C:N/I:N/A:P/E:ND/RL:OF/RC:C'}

cvssV3_0

{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C'}

cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X'}

Subscriptions

Open5gs Open5gs
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-30T22:00:13.319Z

Reserved: 2026-08-30T06:09:46.582Z

Link: CVE-2026-82588

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-30T22:17:00.847

Modified: 2026-08-30T22:17:00.847

Link: CVE-2026-82588

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-30T23:30:18Z

Weaknesses
  • CWE-404

    Improper Resource Shutdown or Release

  • CWE-476

    NULL Pointer Dereference