CVE-2026-108103 in Open5GS
Summary
by MITRE • 10/09/2026
Open5GS through 2.8.0 contains a heap out-of-bounds read vulnerability in ogs_pfcp_parse_dropped_dl_traffic_threshold() that allows remote unauthenticated attackers to read past IE buffers via short IEs. Attackers can send PFCP Session Establishment or Modification Requests to the UPF on UDP port 8805 with DLPA and DLBY flags set, potentially crashing the UPF.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/09/2026
The vulnerability identified in Open5GS versions up through 2.8.0 represents a critical security flaw within the Packet Forwarding Control Protocol implementation of the User Plane Function component. This heap-based out-of-bounds read occurs specifically during the parsing logic for dropped downlink traffic thresholds, triggered by the function ogs_pfcp_parse_dropped_dl_traffic_threshold(). The core technical deficiency lies in the insufficient validation of Information Element lengths before accessing buffer memory. When a remote unauthenticated attacker sends PFCP Session Establishment or Modification Requests to the UPF on UDP port 8805 with both DLPA and DLBY flags set, they can supply short or malformed Information Elements that cause the parser to read beyond the allocated heap boundaries. This lack of bounds checking allows an external actor to access memory contents that should remain inaccessible, potentially leading to information disclosure through data leakage or causing a denial of service by crashing the UPF process due to segmentation faults or undefined behavior resulting from invalid memory reads.
From a threat modeling perspective, this vulnerability aligns with CWE-125, which describes out-of-bounds read vulnerabilities where software reads past the end of an allocated buffer. The attack vector is classified as remote and unauthenticated, meaning no prior access credentials are required to exploit the flaw. In terms of MITRE ATT&CK framework mapping, this activity corresponds to T1046 Network Service Scanning if used for reconnaissance or more critically T1203 Exploitation for Client Execution if it leads to code execution via subsequent exploitation steps, though primarily it facilitates Denial of Service (T1499) by crashing the network function. The ability to crash the UPF disrupts the core mobility management and packet routing capabilities of the 5G standalone core network, effectively halting data sessions for connected user equipment and degrading service availability for all subscribers relying on that specific node.
The operational impact is severe due to the critical role of the User Plane Function in handling actual user traffic. A successful exploit can lead to a complete denial of service by crashing the UPF process, requiring manual restart or recovery procedures which may involve significant downtime depending on high-availability configurations. Additionally, if the heap out-of-bounds read exposes sensitive memory contents such as session keys, subscriber identifiers, or internal routing tables, it could facilitate further lateral movement within the core network infrastructure. This vulnerability highlights the risks associated with parsing complex protocol messages in real-time without rigorous input validation and length verification mechanisms.
Mitigation strategies should prioritize immediate patching to a version of Open5GS greater than 2.8.0 where this issue has been resolved by developers implementing proper bounds checking within the PFCP parser functions. In environments where upgrading is not immediately feasible, network segmentation controls can be employed to restrict access to UDP port 8805 exclusively from trusted control plane nodes and authorized management interfaces, thereby limiting exposure to unauthenticated remote attackers. Implementing strict firewall rules that drop malformed or unusually short PFCP messages with specific flag combinations can also serve as a temporary compensating control. Furthermore, deploying intrusion detection systems capable of identifying anomalous PFCP traffic patterns may help in detecting attempted exploitation activities before they result in service disruption.