Open5GS (2.8.0) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/open5gs-2.8.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 24 Aug 2026 01:40:24 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgOut-of-Bounds Read in Open5GS Rx AA-Request Handlerhttps://feed.craftedsignal.io/briefs/2026-08-open5gs-oob-read/Mon, 24 Aug 2026 01:40:24 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-open5gs-oob-read/Open5GS 2.8.0 contains an out-of-bounds read vulnerability in the pcrf_rx_aar_cb function that allows a remote attacker to potentially cause a service crash or information disclosure.A memory safety vulnerability has been identified in Open5GS 2.8.0, specifically within the Rx AA-Request Handler component. The vulnerability is located in the pcrf_rx_aar_cb function within src/pcrf/pcrf-rx-path.c. An unauthenticated remote attacker can trigger this vulnerability by sending a maliciously crafted AA-Request (AAR) packet to the PCRF (Policy and Charging Rules Function) interface. Successful exploitation results in an out-of-bounds memory read, which can be leveraged to crash the service, leading to a denial-of-service condition, or potentially leak sensitive information from the process memory. The vendor has released a patch in commit c18dc6938bf63cc7374315d3dca303d92066e746. Organizations running Open5GS 2.8.0 should prioritize updating to the patched version.

Attack Chain

  1. The attacker identifies an internet-facing or reachable Open5GS PCRF interface.
  2. The attacker crafts a malicious Diameter AA-Request (AAR) packet.
  3. The attacker transmits the packet to the PCRF component.
  4. The pcrf_rx_aar_cb function processes the incoming AAR request.
  5. The function fails to properly validate memory bounds during the packet parsing process.
  6. An out-of-bounds read occurs, accessing memory outside the intended buffer.
  7. The application encounters a memory error or continues execution using corrupted data.
  8. The service crashes or discloses memory contents to the attacker.

Impact

Successful exploitation of this vulnerability in an Open5GS deployment could lead to a localized denial of service for the core network control plane or the unauthorized exposure of process memory contents. Given that Open5GS is a critical component for 5G core network operations, such disruptions can impact network availability and subscriber connectivity.

Recommendation

  • Upgrade all instances of Open5GS 2.8.0 to a patched version using the fix provided in commit c18dc6938bf63cc7374315d3dca303d92066e746.
  • Implement network-level access control lists (ACLs) to restrict access to the PCRF interface to trusted entities only.
  • Monitor logs for repeated service restarts of the Open5GS PCRF component which may indicate active exploitation attempts.
]]>highthreatcve-2026-78157denial-of-servicememory-corruptionHeap-based Buffer Overflow in Open5GS S6a Authentication-Information-Request Handlerhttps://feed.craftedsignal.io/briefs/2026-08-open5gs-overflow/Mon, 24 Aug 2026 01:40:17 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-open5gs-overflow/Open5GS 2.8.0 contains a remote heap-based buffer overflow vulnerability (CVE-2026-78156) in the S6a Authentication-Information-Request Handler that can be triggered by manipulating the Visited-PLMN-Id argument.A heap-based buffer overflow vulnerability has been identified in Open5GS version 2.8.0, specifically impacting the S6a Authentication-Information-Request Handler. The flaw exists within the hss_ogs_diam_s6a_air_cb function located in the file src/hss/hss-s6a-path.c. An attacker can remotely exploit this vulnerability by providing a specially crafted Visited-PLMN-Id argument to the HSS component. Successful exploitation could lead to memory corruption, potentially causing service crashes or arbitrary code execution. The vulnerability is addressed in the commit a9c82ee0b590d76a581b0580cb46b598984e2392. This issue is significant for operators of 5G core networks using the Open5GS framework, as it allows for unauthorized interaction with the S6a interface.

Attack Chain

  1. Attacker establishes network connectivity to the Diameter S6a interface exposed by the Open5GS HSS component.
  2. Attacker initiates an Authentication-Information-Request (AIR) Diameter message.
  3. Attacker crafts the Visited-PLMN-Id parameter in the DIAMETER message with excessive or malformed data designed to exceed allocated buffer boundaries.
  4. The HSS component parses the incoming message using the vulnerable hss_ogs_diam_s6a_air_cb function.
  5. The function copies the malicious Visited-PLMN-Id value into a heap-allocated buffer without adequate bounds checking.
  6. Memory corruption occurs due to the heap-based buffer overflow, overwriting adjacent heap structures.
  7. Attacker triggers a crash or redirects execution flow to achieve unauthorized impact.

Impact

The vulnerability poses a high risk to the confidentiality, integrity, and availability of 5G core network infrastructure utilizing Open5GS 2.8.0. Successful exploitation of this remote buffer overflow can lead to denial-of-service via service disruption or potential remote code execution on the server hosting the HSS process, compromising core authentication services.

Recommendation

  • Immediately update Open5GS deployments to a version containing the fix for commit a9c82ee0b590d76a581b0580cb46b598984e2392.
  • Implement network-level access control lists (ACLs) to restrict access to the Diameter S6a interface to authorized network elements only.
  • Monitor logs for unusual Diameter traffic patterns or unexpected crashes of the HSS process.
  • Review network configurations to ensure that the HSS component is not unnecessarily exposed to untrusted external networks.
]]>highadvisory