CVE-2026-92416 in Open5GS
Summary
by MITRE • 09/16/2026
A vulnerability has been found in Open5GS up to 2.8.0. Affected by this issue is the function smf_n4_handle_session_report_request of the file src/smf/n4-handler.c of the component PFCP Session Report Request Handler. The manipulation leads to reachable assertion. The attack may be initiated remotely. The identifier of the patch is e5f0c06d0f2d9613b003daa1cfa3ba8a4bd157e9. It is suggested to install a patch to address this issue.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability identified in Open5GS versions up to 2.8.0 resides within the PFCP Session Report Request Handler, specifically affecting the smf_n4_handle_session_report_request function located in src/smf/n4-handler.c. This component is critical for managing session state updates between the Session Management Function and other network elements using the Packet Forwarding Control Protocol. The core technical flaw involves a reachable assertion failure triggered by specific manipulations of incoming PFCP messages. In software development, assertions are typically used to catch programming errors during testing; however, when left enabled in production builds or improperly guarded against malicious input, they can be exploited as denial-of-service vectors. An attacker capable of sending crafted PFCP Session Report Request messages to the SMF interface can trigger this assertion failure, causing the application process to abort unexpectedly.
From an operational perspective, this vulnerability allows for a remote denial-of-service attack without requiring authentication in certain configurations or by exploiting valid session contexts that are already established. Since the 5G core network relies heavily on continuous availability of control plane functions like the SMF, crashing this service can lead to significant disruption in user data sessions and signaling flows. The impact extends beyond simple downtime; it may cause cascading failures if dependent services attempt to reconnect or retry operations against an unresponsive node, potentially leading to broader instability within the 5G core infrastructure. This aligns with CWE-617, which describes a reachable assertion that can be triggered by external input, and maps directly to ATT&CK technique T1499, Endpoint Denial of Service, as it disrupts the availability of critical network functions.
The patch identifier e5f0c06d0f2d9613b003daa1cfa3ba8a4bd157e9 addresses this issue by implementing proper input validation and error handling within the smf_n4_handle_session_report_request function. Instead of allowing malformed or unexpected message structures to trigger a fatal assertion, the updated code likely validates the integrity and format of the PFCP payload before processing it further. This ensures that invalid inputs are gracefully rejected with appropriate error responses rather than causing a process crash. Administrators managing Open5GS deployments should prioritize applying this patch immediately to restore resilience against remote denial-of-service attempts targeting the control plane interface.
Mitigation strategies also include network-level controls such as rate limiting on PFCP traffic and restricting access to the N4 interface to trusted IP addresses only, thereby reducing the attack surface available to potential adversaries. Additionally, ensuring that production builds of Open5GS do not have debug assertions enabled by default provides an additional layer of defense against similar vulnerabilities in other components. Regular security audits and penetration testing focused on protocol implementation flaws are recommended to identify any remaining weaknesses in the handling of control plane messages across the 5G core network elements.