| Titre | Open5GS <=2.8.0 Denial of Service |
|---|
| Description | Open5GS v2.8.0 is affected by a denial-of-service vulnerability in the SMF PFCP Session Report Request handling path. When an associated UPF sends a PFCP Session Report Request for an existing PDU session with the Report Type IE indicating DLDR (Downlink Data Report) while omitting the corresponding Downlink Data Report IE, smf_n4_handle_session_report_request() detects the malformed report and returns a non-success PFCP cause. However, the SMF state machine incorrectly treats any cause other than REQUEST_ACCEPTED as a reason to transition to smf_gsm_state_wait_pfcp_deletion. Because the originating event is a PFCP event rather than an SBI deletion event, the deletion trigger is zero. smf_5gc_pfcp_send_session_deletion_request() subsequently reaches ogs_assert(trigger), causing the open5gs-smfd process to abort. A malicious or compromised UPF, or an attacker capable of impersonating the already-associated UPF and targeting an existing session, can trigger the condition with a single crafted PFCP Session Report Request, resulting in denial of service of the SMF and disruption of PDU session management. The issue was publicly reported to the Open5GS project in GitHub issue #4744. No public CVE identifier is known for this specific issue at the time of submission. |
|---|
| La source | ⚠️ https://github.com/open5gs/open5gs/issues/4744 |
|---|
| Utilisateur | WeiYi (UID 96864) |
|---|
| Soumission | 20/08/2026 14:09 (il y a 27 jours) |
|---|
| Modérer | 16/09/2026 11:37 (27 days later) |
|---|
| Statut | Accepté |
|---|
| Entrée VulDB | 405594 [Open5GS jusqu’à 2.8.0 PFCP Session Report Request src/smf/n4-handler.c smf_n4_handle_session_report_request déni de service] |
|---|
| Points | 20 |
|---|