| शीर्षक | Open5GS 2.7.7 Crash / Denial of Service |
|---|
| विवरण | A crafted PFCP message sequence can crash the Open5GS UPF.
The issue is caused by incomplete handling of a failed GTP-U peer setup triggered through malformed Outer Header Creation data. In Open5GS v2.7.7, the failed setup path can leave a partially initialized GTP-U node in the peer list with an invalid address family. A subsequent PFCP request can reuse this stale state and reach PFCP processing that aborts with:
[pfcp] FATAL: Unknown family(0)
The issue is state-dependent because malformed PFCP processing first leaves invalid runtime state that is later reused by another request.
A successful trigger terminates the UPF process and disrupts the user-plane sessions handled by that UPF.
The vulnerability is reachable by a host that can access the PFCP/N4 interface on UDP port 8805. PFCP does not provide protocol-layer authentication, although N4 is normally deployed on a protected network.
The issue was reported to the Open5GS maintainers as GitHub issue #4699. The maintainers classified it as Type:Security and created a corrective commit explicitly referencing the issue. |
|---|
| स्रोत | ⚠️ https://github.com/open5gs/open5gs/issues/4699 |
|---|
| उपयोगकर्ता | ea1809 (UID 100625) |
|---|
| सबमिशन | 17/08/2026 11:43 AM (1 महीना पहले) |
|---|
| संयम | 15/09/2026 11:10 AM (29 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 404086 [Open5GS तक 2.7.7 PFCP Message lib/pfcp/handler.c सेवा अस्वीकार] |
|---|
| अंक | 20 |
|---|