Remote Use-After-Free Vulnerability in Open5GS

A critical use-after-free vulnerability, tracked as CVE-2026-90707, exists in Open5GS versions up to 2.7.x. The issue resides within the 'amf_nnrf_try_old_amf_discovery_fallback' function located in 'src/amf/nnrf-handler.c'. An attacker can remotely exploit this flaw by providing a crafted 'discovery_option' argument to the NNRF (Non-3GPP Interworking Function) handler. This manipulation causes the application to access memory after it has been freed, which may lead to application crashes or potentially arbitrary code execution in the context of the Open5GS service. Security teams should prioritize patching this component, as the Open5GS service acts as a core node in 5G network infrastructure.

Impact

Successful exploitation of this vulnerability could result in a denial of service (DoS) through application process termination or, in more complex scenarios, arbitrary code execution on the underlying server. Because Open5GS is a critical component in 5G core networks, a service outage could disrupt network connectivity for connected users.

Recommendation

• Upgrade all Open5GS installations to a version containing the fix identified by commit hash 'ddd683a35f8aaac2b7b9884a24cd53bddfc65238'.
• Monitor network traffic logs for anomalous NNRF API requests involving unexpected or overly long 'discovery_option' values that target the AMF component.
• Implement network segmentation to isolate the Open5GS AMF service from untrusted or external networks to limit the attack surface for remote exploitation.