CVE-2026-107166 in Open5GS
Summary
by MITRE • 10/07/2026
A weakness has been identified in Open5GS up to 2.7.7. This vulnerability affects the function ogs_pfcp_xact_local_create of the file src/upf/gtp-path.c of the component GTP-U Receive Path. This manipulation causes allocation of resources. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. Patch name: 9ffc252482d9b03ac01abcedbe95497ff4f95dd0. It is recommended to apply a patch to fix this issue.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/07/2026
The identified vulnerability resides within the Open5GS software suite, specifically affecting versions up to 2.7.7, and targets the GTP-U Receive Path component which handles signaling for mobile network data sessions. The core technical flaw is located in the function ogs_pfcp_xact_local_create found in the source file src/upf/gtp-path.c. This function is responsible for managing Packet Forwarding Control Protocol (PFCP) transactions, a critical protocol used between the User Plane Function and Session Management Function in 5G networks to establish, modify, or delete data paths. The specific weakness manifests as an improper resource allocation mechanism that fails to adequately validate input parameters or manage memory limits during transaction creation. This oversight allows for uncontrolled consumption of system resources, leading directly to a denial-of-service condition where the affected service becomes unavailable due to exhaustion of available memory or processing capacity.
From a technical perspective, this vulnerability aligns with CWE-400, which describes Uncontrolled Resource Consumption. The flaw permits an attacker who can interact with the GTP-U interface to trigger repeated allocations without corresponding cleanup or bounds checking. Because the GTP-U protocol is designed for high-throughput mobile data traffic, it processes a significant volume of packets continuously. An adversary leveraging this weakness does not need complex payloads; rather, they simply need to send specific malformed or rapidly repeating PFCP messages that invoke the vulnerable function repeatedly. This results in the server allocating resources faster than they can be released, eventually causing the application to crash or become unresponsive. The impact is severe for network operators as it compromises the availability of core network functions essential for maintaining connectivity for end-users.
The operational risk associated with this vulnerability is heightened by its remote exploitability and the public availability of proof-of-concept exploits. Since GTP-U operates over UDP, an attacker can initiate these resource-draining attacks from a remote location without requiring prior authentication or access to the internal network infrastructure, provided they have IP connectivity to the user plane interface. This characteristic places the vulnerability within the MITRE ATT&CK framework under techniques related to Resource Hijacking and Denial of Service, specifically those that target application layer services. The public availability of exploits means that automated scanning tools and opportunistic attackers can easily identify vulnerable instances on the internet or exposed internal networks, leading to a high likelihood of successful exploitation in unpatched environments.
To mitigate this risk, immediate action is required by applying the patch identified as commit 9ffc252482d9b03ac01abcedbe95497ff4f95dd0. This update addresses the root cause within the ogs_pfcp_xact_local_create function by implementing proper resource management and validation checks before allocation occurs. In addition to applying the software patch, network operators should implement strict rate limiting on GTP-U traffic at the perimeter firewall or load balancer level to mitigate potential attacks while patches are being deployed. Monitoring logs for unusual spikes in PFCP transaction creation rates can also serve as an early detection mechanism for exploitation attempts. Ensuring that Open5GS instances are updated to version 2.7.8 or later is critical to restoring the integrity and availability of the mobile core network infrastructure against this specific resource exhaustion vector.