| Title | Open5GS v2.7.5 Denial of Service |
|---|
| Description | Open5GS v2.7.5 is affected by a denial-of-service vulnerability in the SMF Diameter Gx Credit-Control-Answer (CCA) handling path. In a 4G EPC deployment, when multiple UEs attach and detach in quick succession, especially when the same IMSI reattaches before the previous session cleanup has fully completed, the SMF may receive a delayed Gx CCA response for a Diameter transaction whose associated SMF session has already been removed. The callback smf_gx_cca_cb() then attempts to access the removed session and triggers a fatal assertion failure.
As a result, the open5gs-smfd process terminates instead of gracefully ignoring or rejecting the late CCA response. An attacker or misbehaving Diameter peer that can influence Gx CCA timing or send delayed CCA responses may be able to crash the SMF process, causing denial of service for active and new UE sessions.
The issue was publicly reported to the Open5GS project in GitHub issue #4027. No public CVE identifier is known for this specific delayed-CCA-after-session-removal issue at the time of submission. |
|---|
| Source | ⚠️ https://github.com/open5gs/open5gs/issues/4027 |
|---|
| User | WeiYi (UID 96864) |
|---|
| Submission | 06/24/2026 08:56 (2 months ago) |
|---|
| Moderation | 08/09/2026 19:50 (2 months later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 387283 [Open5GS up to 2.7.6 SMF Diameter Gx Credit-Control-Answer smf_gx_cca_cb denial of service] |
|---|
| Points | 20 |
|---|