CVE-2026-91855 - Vulnerability Details

- Open5GS PFCP Message handler.c denial of service

Description

A security flaw has been discovered in Open5GS up to 2.7.7. Affected by this vulnerability is an unknown functionality of the file lib/pfcp/handler.c of the component PFCP Message Handler. Performing a manipulation results in denial of service. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The patch is named 028e1dbb5e3271035ccee906ef417a97fc523f71. Applying a patch is the recommended action to fix this issue. CVE-2025-29339 describes a different assertion failure vulnerability in Open5GS UPF.

Published: 2026-09-15

Score: 6.9 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A flaw in the Open5GS PFCP Message Handler, specifically in lib/pfcp/handler.c, allows a remote attacker to cause a denial of service by sending a carefully crafted PFCP message. The vulnerability triggers a resource exhaustion or crash in the server component, interrupting service availability. The weakness is classified as CWE-404.

Affected Systems

The vulnerability affects the Open5GS platform, versions up to and including 2.7.7. All stack that have not applied the fix identified by commit 028e1dbb5e3271035ccee906ef417a97fc523f71 are potentially exposed.

Risk and Exploitability

With a CVSS score of 6.9 and an EPSS score of less than 1%, the vulnerability presents a moderate risk. Public exploits have been released, and remote exploitation is possible. An attacker can manipulate network traffic to a PFCP endpoint, triggering a denial of service and potentially disrupting 5G network operations.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

n/a

Open5GS

affected

Version	Status	Constraints
`2.7.0`	affected	—
`2.7.1`	affected	—
`2.7.2`	affected	—
`2.7.3`	affected	—
`2.7.4`	affected	—
`2.7.5`	affected	—
`2.7.6`	affected	—
`2.7.7`	affected	—

No data.

Vendor Product Confidence Versions

Open5gs

95%

Version	Status	Scheme	Platform
`[2.7.0,2.7.7]`	affected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update Open5GS to a version newer than 2.7.7 or apply the patch 028e1dbb5e3271035ccee906ef417a97fc523f71.
Apply firewall or ACL rules to restrict PFCP traffic to known, trusted peers.
Implement rate limiting or deep‑packet inspection on PFCP traffic to detect and drop malformed messages before they reach the server.

Generated by OpenCVE AI on September 20, 2026 at 15:17 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact None

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.00724.

Exploitation poc

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/open5gs/open5gs/
https://github.com/open5gs/open5gs/commit/028e1dbb5e3271035ccee906ef417a97fc523f71
https://github.com/open5gs/open5gs/issues/4699
https://vuldb.com/cve/CVE-2026-91855
https://vuldb.com/submit/933834
https://vuldb.com/vuln/404086
https://vuldb.com/vuln/404086/cti

History

Tue, 15 Sep 2026 18:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 15 Sep 2026 17:00:00 +0000

Type	Values Removed	Values Added
Description		A security flaw has been discovered in Open5GS up to 2.7.7. Affected by this vulnerability is an unknown functionality of the file lib/pfcp/handler.c of the component PFCP Message Handler. Performing a manipulation results in denial of service. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The patch is named 028e1dbb5e3271035ccee906ef417a97fc523f71. Applying a patch is the recommended action to fix this issue. CVE-2025-29339 describes a different assertion failure vulnerability in Open5GS UPF.
Title		Open5GS PFCP Message handler.c denial of service
First Time appeared		Open5gs Open5gs open5gs
Weaknesses		CWE-404
CPEs		cpe:2.3:a:open5gs:open5gs::::::::
Vendors & Products		Open5gs Open5gs open5gs
References		https://github.com/open5gs/open5gs/ https://github.com/open5gs/open5gs/commit/028e1dbb5e3271035ccee906ef417a97fc523f71 https://github.com/open5gs/open5gs/issues/4699 https://vuldb.com/cve/CVE-2026-91855 https://vuldb.com/submit/933834 https://vuldb.com/vuln/404086 https://vuldb.com/vuln/404086/cti
Metrics		cvssV2_0 `{'score': 5, 'vector': 'AV:N/AC:L/Au:N/C:N/I:N/A:P/E:POC/RL:OF/RC:C'}` cvssV3_0 `{'score': 5.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C'}` cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C'}` cvssV4_0 `{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P'}`

Subscriptions

Open5gs Open5gs

MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2026-09-15T16:45:07.926Z

Updated: 2026-09-15T17:44:40.050Z

Reserved: 2026-09-15T09:10:03.977Z

Link: CVE-2026-91855

Vulnrichment

Updated: 2026-09-15T17:44:36.555Z

NVD

Status : Deferred

Published: 2026-09-15T17:17:39.867

Modified: 2026-09-16T13:42:49.240

Link: CVE-2026-91855

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-20T15:30:17Z

Weaknesses

CWE-404
Improper Resource Shutdown or Release

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact None

Availability Impact Partial

Exploitation poc

Automatable yes

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object