CVE-2026-116543 in Open5GS
Summary
by MITRE • 10/26/2026
Open5GS 1.3.0 through 2.8.0 contains a heap out-of-bounds write vulnerability in parse_multipart() that allows unauthenticated attackers to corrupt memory by supplying an empty multipart boundary. Attackers can send a single crafted multipart/related request to the SBI interface of any network function, overflowing the lookbehind buffer and crashing it.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/26/2026
The identified vulnerability resides within the Open5GS core platform, specifically affecting versions 1.3.0 through 2.8.0 in the parse_multipart() function responsible for processing multipart/related HTTP requests on the Service Based Interface SBI. This interface serves as a critical communication channel between various network functions such as the Access and Mobility Management Function AMF Session Management Function SMF and Unified Data Management UDM within the 5G core architecture. The flaw is characterized by an improper handling of boundary parameters in multipart message parsing logic which leads to a heap-based out-of-bounds write condition when an attacker supplies an empty or malformed multipart boundary string during request processing.
From a technical perspective, the vulnerability stems from insufficient validation and bounds checking within the parser implementation. When the parse_multipart() function receives a crafted HTTP POST request with a content-type header specifying multipart/related but containing an empty boundary parameter in the Content-Type field it proceeds to process the body without adequately verifying the structural integrity of the data segments. This oversight causes the internal lookbehind buffer used for parsing context and state tracking to overflow beyond its allocated heap memory region. The resulting memory corruption allows unauthenticated remote attackers to overwrite adjacent heap metadata or application-specific variables potentially leading to arbitrary code execution control flow hijacking denial of service through segmentation faults or other exploitable behaviors depending on the specific runtime environment and compiler protections in place.
The operational impact of this vulnerability is severe due to its location within a core network function accessible via standard HTTP/2 protocols commonly used in 5G SBI implementations. Since no authentication is required to trigger the initial parsing logic an unauthenticated adversary can remotely exploit this flaw from any connected endpoint on the same network segment or potentially over public internet if exposed services are not properly firewalled. Successful exploitation could result in complete compromise of the affected network function leading to disruption of subscriber mobility management session establishment and data path configuration. In a production 5G environment such an incident would cause widespread service degradation including dropped calls failed handovers inability to establish new sessions and potential leakage of sensitive user plane or control plane signaling information depending on what memory structures are overwritten during exploitation attempts.
This vulnerability aligns with Common Weakness Enumeration CWE-122 heap-based buffer overflow which describes writing data beyond the bounds of a heap allocated buffer often resulting in corruption of internal data structures such as allocation metadata and adjacent objects it also relates to CWE-787 out-of-bounds write where memory is written outside the intended destination range. In terms of adversary tactics this exploit scenario maps closely to MITRE ATT&CK technique T1059 command execution via buffer overflow exploitation which falls under initial access or privilege escalation phases depending on whether the attacker gains shell access or merely disrupts service availability through denial-of-service conditions caused by memory corruption crashes.
Mitigation strategies should prioritize immediate patching of Open5GS to version 2.8.1 or later where this parsing logic has been corrected with proper boundary validation and bounds checking implemented in the parse_multipart() function organizations unable to apply patches immediately should implement strict input filtering at the network perimeter using web application firewalls WAFs configured to detect malformed multipart requests specifically those containing empty boundaries or suspiciously structured content-type headers. Additionally deploying intrusion detection systems IDS rules that monitor for anomalous HTTP request patterns targeting SBI endpoints can provide early warning indicators of exploitation attempts while restricting direct exposure of core network functions to untrusted networks remains a fundamental security best practice in 5G deployments.