CVE-2026-37198 in Open5GS
Summary
by MITRE • 08/27/2026
An integer overflow in the SMF component of Open5GS v2.7.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted GTP packet.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/27/2026
The vulnerability identified as an integer overflow within the Session Management Function, or SMF, of Open5GS version 2.7.6 represents a critical flaw in how the system processes incoming General Packet Radio System packets. The SMF is a central control plane element in 5G and LTE networks responsible for managing user session establishment, modification, and termination. When an attacker transmits a specially crafted GTP packet to this component, they can trigger an arithmetic error during the calculation of buffer sizes or data lengths associated with the packet payload. This integer overflow occurs because the system fails to properly validate whether the numerical value provided in the packet header exceeds the maximum limit that can be represented by the variable type used for storage and processing. Consequently, the calculated size wraps around to a small positive number rather than failing safely, leading the application to allocate insufficient memory or misinterpret the boundaries of the data buffer.
From an operational perspective, this flaw directly impacts the availability of the network infrastructure. Because the miscalculated buffer allocation does not match the actual size of the incoming packet data, subsequent operations that write the packet content into the allocated space result in a heap-based buffer overflow. This memory corruption typically causes immediate application crashes or segmentation faults within the SMF process. Since Open5GS is often deployed as an open-source implementation of 5G core network functions, such instability can lead to widespread service disruption for connected users who rely on data sessions managed by this instance. The denial of service effect is achieved without requiring authentication in many default configurations, allowing unauthenticated remote attackers to disrupt critical telecommunications services simply by sending malformed packets over the GTP-U or GTP-C interfaces.
This vulnerability aligns with Common Weakness Enumeration identifier CWE-190, which describes integer overflow or wraparound errors that can lead to other vulnerabilities such as buffer overflows. In terms of attack vectors and tactics, this flaw is consistent with MITRE ATT&CK techniques related to resource exhaustion and denial of service via protocol abuse. The exploitation relies on the attacker's ability to reach the GTP interface, which in some deployments may be exposed directly or through insufficient network segmentation between untrusted networks and core network functions. The lack of strict input validation for numeric fields in the packet headers is a fundamental design oversight that allows malicious actors to manipulate internal state calculations.
Mitigation strategies must focus on both immediate remediation and long-term architectural improvements. Upgrading Open5GS to versions where this integer overflow has been patched by the developers is the primary defense, as these updates typically include rigorous input validation checks before arithmetic operations are performed on packet fields. Network administrators should also implement strict access control lists at the network perimeter to restrict GTP traffic to trusted IP addresses belonging only to legitimate peer networks and user equipment proxies. Additionally, deploying deep packet inspection solutions capable of detecting malformed or unusually large GTP packets can help filter out malicious payloads before they reach the vulnerable SMF component. Regular security audits focusing on input validation in C-based systems are essential to prevent similar integer manipulation flaws from being introduced during future development cycles.