CVE-2026-71675 in Open5GS
Summary
by MITRE • 08/18/2026
An issue in Open5GS v.2.7.0 allows a remote attacker to cause a denial of service via the ngap_send_to_nas() function in src/amf/ngap-path.c
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/18/2026
The vulnerability identified in Open5GS version 2.7.0 represents a critical reliability flaw within the Next Generation Application Protocol (NGAP) implementation, specifically located in the source file src/amf/ngap-path.c. This software serves as an open-source core network solution for Long Term Evolution and Fifth Generation mobile networks, functioning primarily as the Access and Mobility Management Function or Session Management Function depending on deployment configuration. The specific function ngap_send_to_nas() is responsible for encapsulating NGAP messages into Non-Access Stratum protocols to be transmitted to user equipment over the radio interface. A defect in this pathway allows a remote attacker to trigger a denial of service condition, effectively disrupting network operations without requiring authentication or prior access privileges.
The technical root cause lies in improper input validation and error handling within the ngap_send_to_nas() function. When processing incoming NGAP messages from connected base stations or other core network elements, the application fails to adequately verify the integrity or bounds of specific data structures before attempting to map them to NAS protocols. This oversight can lead to memory corruption, such as a buffer overflow or use-after-free scenario, depending on the exact nature of the malformed input. Alternatively, it may result in an unhandled exception that causes the AMF process to crash or enter an unrecoverable error state. In either case, the immediate consequence is the termination of the Open5GS service instance handling the affected session, leading to a loss of connectivity for all users associated with that specific node or context.
From an operational perspective, this vulnerability poses a severe risk to network availability and integrity. Since NGAP handles critical control plane signaling including initial attachment, handover management, and paging procedures, compromising this function can effectively paralyze the mobile core's ability to manage user sessions. An attacker exploiting this flaw could cause repeated service disruptions by sending crafted packets that trigger the fault condition repeatedly or sustainably. This aligns with Common Weakness Enumeration category CWE-20 Improper Input Validation, as the system accepts and processes data from an external source without sufficient checks on its validity or structure. Furthermore, because NGAP operates over SCTP/TCP connections typically exposed to trusted but potentially compromised network segments in 5G architectures, this represents a significant attack surface for insider threats or lateral movement by adversaries who have breached perimeter defenses.
The exploitation of this vulnerability maps directly to MITRE ATT&CK techniques related to Denial of Service against infrastructure components and resource exhaustion attacks. Specifically, it falls under the Tactic Impact category, focusing on disrupting availability rather than compromising confidentiality or integrity at this stage. However, in a production environment, such instability can be leveraged as part of a broader campaign to degrade service quality for competitive advantage or malicious disruption. The lack of robust state machine recovery mechanisms means that once triggered, the AMF may require manual intervention or automatic restarts to restore normal operations, introducing latency and potential data loss during the transition period.
Mitigation strategies must address both immediate remediation and long-term architectural resilience. The primary solution is to apply vendor-provided patches immediately upon release for Open5GS versions subsequent to 2.7.0 where this issue has been resolved. For environments unable to upgrade instantly, network segmentation should be enforced to restrict NGAP traffic exclusively to authorized base stations using strict firewall rules and IP allow-listing. Additionally, deploying deep packet inspection solutions capable of validating SCTP payload structures can help filter out malformed messages before they reach the vulnerable application layer. Developers must also implement rigorous fuzz testing during future development cycles to identify similar input validation gaps in other NGAP processing functions. Ensuring that the AMF runs with minimal privileges and utilizes automatic restart policies with health checks can further reduce the blast radius of such incidents, maintaining higher levels of service continuity despite potential software defects.