CVE-2025-46115 in Open5GS
Summary
by MITRE • 04/30/2026
An issue in open5gs v.2.7.3 allows a remote attacker to cause a denial of service via a crafted PDU Session Modification Request
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/03/2026
The vulnerability in open5gs version 2.7.3 represents a critical remote denial of service condition that arises from improper handling of crafted PDU Session Modification Request messages within the 5G core network infrastructure. This flaw exists within the session management functionality of the open5gs software stack, which serves as an open-source implementation of the 5G core network components including the AMF, SMF, and UPF. The issue stems from insufficient input validation and sanitization mechanisms when processing session modification requests that are transmitted over the N2 interface between the gNodeB and the SMF. When a remote attacker crafts a malicious PDU Session Modification Request containing malformed or unexpected parameters, the system fails to properly validate these inputs before attempting to process the session modification operation. This failure creates a path for arbitrary code execution or memory corruption that ultimately results in the complete termination of the affected service component.
The technical root cause of this vulnerability can be categorized as a buffer overflow or improper input validation issue that aligns with CWE-121 and CWE-787, representing weaknesses in the handling of dynamically allocated memory and insufficient boundary checks. The attack scenario involves an adversary who has network access to the 5G core network's N2 interface to send specially crafted PDU Session Modification Request messages designed to trigger the vulnerable code path within the session management module. When the system attempts to process these malformed requests, it executes code that leads to a segmentation fault or heap corruption, causing the service to crash and become unavailable. The vulnerability affects the SMF component specifically, which is responsible for managing session context information and coordinating with other network elements during session modifications.
The operational impact of this vulnerability extends beyond simple service disruption as it can compromise the availability of critical 5G network services including voice calls, data transmission, and IoT connectivity for all subscribers served by the affected open5gs instance. Network operators relying on this software stack face potential service degradation that could affect thousands of users simultaneously, particularly in environments where multiple session modifications occur concurrently. The attack requires minimal privileges and can be executed from anywhere on the network where the attacker has access to the N2 interface, making it highly dangerous for production deployments. The vulnerability also creates opportunities for further exploitation as service disruption may enable additional attack vectors or provide cover for more sophisticated intrusions.
Mitigation strategies for this vulnerability include immediate deployment of patches released by the open5gs development team that implement proper input validation and boundary checking mechanisms for PDU Session Modification Request processing. Network operators should also implement network segmentation and access controls to limit exposure of the N2 interface to trusted networks only, reducing the attack surface available to remote adversaries. Additional monitoring and intrusion detection systems should be configured to detect anomalous PDU Session Modification Request patterns that may indicate exploitation attempts. The implementation of rate limiting and connection throttling mechanisms can help prevent rapid exploitation attempts from overwhelming the system. Security teams should also consider deploying network traffic analysis tools that can identify malformed session modification requests and automatically block them at the network perimeter. These defensive measures align with ATT&CK technique T1499.004 for network denial of service and support broader cybersecurity frameworks such as NIST SP 800-53 family controls for availability and integrity protection. Organizations should also conduct regular vulnerability assessments and penetration testing to identify similar weaknesses in their deployed 5G infrastructure components.