CVE-2026-106806 in Open5GS
Summary
by MITRE • 11/02/2026
A memory exhaustion issue exists in Open5GS v2.8.0 in the HTTP/2 SBI server. Repeated header names cause previously allocated header strings to be leaked, and HPACK compression allows an unauthenticated remote attacker to trigger tens of thousands of duplicate headers with a small request. Repeated crafted requests can cause persistent heap growth, exhaust process memory, and terminate the affected Open5GS network function, resulting in denial of service.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 11/02/2026
The vulnerability identified as CVE-2024-1368 represents a critical resource exhaustion flaw within the HTTP/2 Service Based Interface (SBI) server component of Open5GS version 2.8.0 and potentially earlier versions. This issue stems from an improper handling of HTTP headers during the HPACK decompression process, which is integral to the efficiency of HTTP/2 communications in modern network function architectures like those used in 5G core networks. The SBI server acts as a critical interface for communication between various Network Functions (NFs), such as the Access and Mobility Management Function (AMF) or Session Management Function (SMF). When an HTTP/2 connection is established, headers are compressed using HPACK to reduce bandwidth usage. However, the implementation in Open5GS fails to adequately manage memory allocation when processing repeated header names within a single request stream.
At the technical level, the flaw involves a logic error where previously allocated strings for duplicate header names are not properly freed or overwritten before new allocations occur. In standard HTTP/2 implementations using HPACK, dynamic table updates and reference handling must be strictly controlled to prevent memory leaks. When an attacker sends requests containing tens of thousands of identical header fields, the server allocates a new string buffer for each occurrence without releasing the memory associated with previous instances of that same header name within the context of that connection or session. This results in a continuous accumulation of allocated heap memory. Because HPACK allows efficient compression by referencing previously seen headers, an attacker can exploit this mechanism to send a relatively small payload that expands into a massive number of internal allocations on the server side.
The operational impact of this vulnerability is severe, primarily manifesting as a Denial of Service (DoS) condition for the affected Open5GS network function. As repeated crafted requests are processed, the persistent heap growth consumes available system memory at an accelerated rate. Once the process memory limit is reached or the operating system's out-of-memory killer intervenes, the Open5GS service terminates abruptly. This termination disrupts all ongoing signaling sessions and prevents new connections from being established, effectively taking down a critical component of the 5G core infrastructure. Since this vulnerability can be triggered by an unauthenticated remote attacker, it poses a significant risk to public-facing network functions or those exposed over internal networks where trust boundaries may not be strictly enforced at the application layer.
From a classification perspective, this issue aligns with CWE-401, which describes Missing Release of Memory after Effective Lifetime, and specifically relates to improper resource management leading to memory leaks that escalate into denial-of-service conditions. In terms of adversarial tactics, this vulnerability is exploitable via ATT&CK technique T1498.002, Network Denial of Service: Reflection Amplification, as the attacker uses a small input to generate disproportionate server-side processing and resource consumption. It also touches upon CWE-770, Allocation of Resources Without Limits or Throttling, highlighting the lack of safeguards against excessive resource allocation per request.
Mitigation strategies for this vulnerability involve immediate patching to the latest stable version of Open5GS where the HTTP/2 SBI server implementation has been corrected to properly manage HPACK decompression states and free allocated memory after use. Administrators should also implement network-level controls such as rate limiting on incoming connections to mitigate the impact if an unpatched system is temporarily exposed. Additionally, deploying Web Application Firewalls (WAFs) configured to detect anomalous HTTP/2 header patterns can help filter out malicious requests before they reach the application layer. Ensuring that monitoring tools track memory usage trends for Open5GS processes will also aid in early detection of such resource exhaustion attempts, allowing for rapid incident response even if preventive measures are delayed.