{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/open5gs-2.8.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.4,"id":"CVE-2026-78157"}],"_cs_exploited":true,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Open5GS (2.8.0)"],"_cs_severities":["high"],"_cs_tags":["cve-2026-78157","denial-of-service","memory-corruption"],"_cs_type":"threat","_cs_vendors":[],"content_html":"\u003cp\u003eA memory safety vulnerability has been identified in Open5GS 2.8.0, specifically within the Rx AA-Request Handler component. The vulnerability is located in the \u003ccode\u003epcrf_rx_aar_cb\u003c/code\u003e function within \u003ccode\u003esrc/pcrf/pcrf-rx-path.c\u003c/code\u003e. An unauthenticated remote attacker can trigger this vulnerability by sending a maliciously crafted AA-Request (AAR) packet to the PCRF (Policy and Charging Rules Function) interface. Successful exploitation results in an out-of-bounds memory read, which can be leveraged to crash the service, leading to a denial-of-service condition, or potentially leak sensitive information from the process memory. The vendor has released a patch in commit \u003ccode\u003ec18dc6938bf63cc7374315d3dca303d92066e746\u003c/code\u003e. Organizations running Open5GS 2.8.0 should prioritize updating to the patched version.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker identifies an internet-facing or reachable Open5GS PCRF interface.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a malicious Diameter AA-Request (AAR) packet.\u003c/li\u003e\n\u003cli\u003eThe attacker transmits the packet to the PCRF component.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003epcrf_rx_aar_cb\u003c/code\u003e function processes the incoming AAR request.\u003c/li\u003e\n\u003cli\u003eThe function fails to properly validate memory bounds during the packet parsing process.\u003c/li\u003e\n\u003cli\u003eAn out-of-bounds read occurs, accessing memory outside the intended buffer.\u003c/li\u003e\n\u003cli\u003eThe application encounters a memory error or continues execution using corrupted data.\u003c/li\u003e\n\u003cli\u003eThe service crashes or discloses memory contents to the attacker.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability in an Open5GS deployment could lead to a localized denial of service for the core network control plane or the unauthorized exposure of process memory contents. Given that Open5GS is a critical component for 5G core network operations, such disruptions can impact network availability and subscriber connectivity.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade all instances of Open5GS 2.8.0 to a patched version using the fix provided in commit \u003ccode\u003ec18dc6938bf63cc7374315d3dca303d92066e746\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eImplement network-level access control lists (ACLs) to restrict access to the PCRF interface to trusted entities only.\u003c/li\u003e\n\u003cli\u003eMonitor logs for repeated service restarts of the Open5GS PCRF component which may indicate active exploitation attempts.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-24T01:40:24Z","date_published":"2026-08-24T01:40:24Z","id":"https://feed.craftedsignal.io/briefs/2026-08-open5gs-oob-read/","summary":"Open5GS 2.8.0 contains an out-of-bounds read vulnerability in the pcrf_rx_aar_cb function that allows a remote attacker to potentially cause a service crash or information disclosure.","title":"Out-of-Bounds Read in Open5GS Rx AA-Request Handler","url":"https://feed.craftedsignal.io/briefs/2026-08-open5gs-oob-read/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.4,"id":"CVE-2026-78156"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Open5GS (2.8.0)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Open5GS"],"content_html":"\u003cp\u003eA heap-based buffer overflow vulnerability has been identified in Open5GS version 2.8.0, specifically impacting the S6a Authentication-Information-Request Handler. The flaw exists within the \u003ccode\u003ehss_ogs_diam_s6a_air_cb\u003c/code\u003e function located in the file \u003ccode\u003esrc/hss/hss-s6a-path.c\u003c/code\u003e. An attacker can remotely exploit this vulnerability by providing a specially crafted \u003ccode\u003eVisited-PLMN-Id\u003c/code\u003e argument to the HSS component. Successful exploitation could lead to memory corruption, potentially causing service crashes or arbitrary code execution. The vulnerability is addressed in the commit \u003ccode\u003ea9c82ee0b590d76a581b0580cb46b598984e2392\u003c/code\u003e. This issue is significant for operators of 5G core networks using the Open5GS framework, as it allows for unauthorized interaction with the S6a interface.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker establishes network connectivity to the Diameter S6a interface exposed by the Open5GS HSS component.\u003c/li\u003e\n\u003cli\u003eAttacker initiates an Authentication-Information-Request (AIR) Diameter message.\u003c/li\u003e\n\u003cli\u003eAttacker crafts the \u003ccode\u003eVisited-PLMN-Id\u003c/code\u003e parameter in the DIAMETER message with excessive or malformed data designed to exceed allocated buffer boundaries.\u003c/li\u003e\n\u003cli\u003eThe HSS component parses the incoming message using the vulnerable \u003ccode\u003ehss_ogs_diam_s6a_air_cb\u003c/code\u003e function.\u003c/li\u003e\n\u003cli\u003eThe function copies the malicious \u003ccode\u003eVisited-PLMN-Id\u003c/code\u003e value into a heap-allocated buffer without adequate bounds checking.\u003c/li\u003e\n\u003cli\u003eMemory corruption occurs due to the heap-based buffer overflow, overwriting adjacent heap structures.\u003c/li\u003e\n\u003cli\u003eAttacker triggers a crash or redirects execution flow to achieve unauthorized impact.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability poses a high risk to the confidentiality, integrity, and availability of 5G core network infrastructure utilizing Open5GS 2.8.0. Successful exploitation of this remote buffer overflow can lead to denial-of-service via service disruption or potential remote code execution on the server hosting the HSS process, compromising core authentication services.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately update Open5GS deployments to a version containing the fix for commit \u003ccode\u003ea9c82ee0b590d76a581b0580cb46b598984e2392\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eImplement network-level access control lists (ACLs) to restrict access to the Diameter S6a interface to authorized network elements only.\u003c/li\u003e\n\u003cli\u003eMonitor logs for unusual Diameter traffic patterns or unexpected crashes of the HSS process.\u003c/li\u003e\n\u003cli\u003eReview network configurations to ensure that the HSS component is not unnecessarily exposed to untrusted external networks.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-24T01:40:17Z","date_published":"2026-08-24T01:40:17Z","id":"https://feed.craftedsignal.io/briefs/2026-08-open5gs-overflow/","summary":"Open5GS 2.8.0 contains a remote heap-based buffer overflow vulnerability (CVE-2026-78156) in the S6a Authentication-Information-Request Handler that can be triggered by manipulating the Visited-PLMN-Id argument.","title":"Heap-based Buffer Overflow in Open5GS S6a Authentication-Information-Request Handler","url":"https://feed.craftedsignal.io/briefs/2026-08-open5gs-overflow/"}],"language":"en","title":"CraftedSignal Threat Feed - Open5GS (2.8.0)","version":"https://jsonfeed.org/version/1.1"}