CVE-2026-30046 in Open5GS
Summary
by MITRE • 08/27/2026
A reachable assertion vulnerability in the NUDM-UECM interface of Open5GS v2.7.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted DELETE request.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/27/2026
The identified security flaw resides within the Network Data Repository Function, specifically targeting the User Equipment Context Management interface in version 2.7.6 of Open5GS. This vulnerability is classified as an assertion failure that can be triggered remotely by an authenticated attacker interacting with the NUDM-UECM service endpoints. The core technical issue stems from a lack of rigorous input validation and boundary checking when processing DELETE requests directed at user context resources. In C-based systems like Open5GS, assertions are typically used during development to catch programming errors that should never occur under normal operating conditions. However, in production builds where these checks may remain enabled or fail gracefully only by terminating the process rather than handling the error state, a malformed request can cause the application to abort unexpectedly.
The operational impact of this vulnerability is significant as it directly facilitates a Denial of Service attack against the 5G core network infrastructure. By sending a specifically crafted DELETE request that violates internal assumptions about data structure integrity or resource states, an attacker can force the NUDM process to crash. Since the User Data Management function is critical for maintaining subscriber profiles and authentication vectors, its unavailability disrupts essential signaling flows such as registration, mobility management, and session establishment. This disruption effectively isolates affected user equipment from the network, leading to a complete loss of service for subscribers relying on that specific instance or cluster node within the 5G core architecture.
From a threat modeling perspective, this vulnerability aligns with CWE-617, which describes Reachable Assertion, indicating that an assertion condition can be triggered by external input due to insufficient validation. Furthermore, in terms of adversarial tactics, this behavior corresponds to MITRE ATT&CK technique T1499, Endpoint Denial of Service, where the attacker aims to exhaust or disrupt resources rather than compromise confidentiality or integrity. The attack vector is network-based and requires authentication, placing it within the context of authenticated remote exploitation against critical infrastructure components.
Mitigation strategies should focus on immediate patching to a version of Open5GS that addresses this assertion handling logic. Administrators must ensure that production builds are configured with assertions disabled if they do not provide meaningful security guarantees beyond debugging aids, or alternatively, implement robust error handling routines that catch these exceptions and return appropriate HTTP status codes instead of crashing the process. Additionally, deploying web application firewalls or API gateways in front of core network functions can help filter out malformed requests before they reach the vulnerable service layer. Regular auditing of input validation logic across all NUDM endpoints is recommended to prevent similar assertion-based crashes from occurring through other interface methods such as GET or PUT operations that might share underlying data parsing routines.