| Title | Open5GS 2.7.7 Reachable Assertion leading to Remote Denial of Service |
|---|
| Description | A remote denial-of-service vulnerability affects the Open5GS v2.7.7 UPF when processing repeated GTP-U Error Indication messages associated with an existing tunnel/session.
Each matching Error Indication causes the UPF to create a local PFCP transaction and send a PFCP Session Report Request. If the corresponding Session Report Responses are absent or sufficiently delayed, these transactions remain outstanding and consume PFCP transaction and timer resources.
Each PFCP transaction allocates three timer objects (tm_response, tm_holding, and tm_delayed_commit). Once the global timer pool is exhausted, ogs_pfcp_xact_local_create() fails and upf_pfcp_send_session_report_request() returns OGS_ERROR.
In Open5GS v2.7.7, the GTP-U receive path in src/upf/gtp-path.c handles this error with a fatal ogs_assert(), causing open5gs-upfd to abort.
The issue was reproduced with global.max.ue=1024; approximately 5.5k outstanding Session Report transactions were sufficient to exhaust the 16384-entry timer pool in the test environment. The exact threshold is configuration- and timing-dependent.
The Open5GS maintainers acknowledged the report as a security issue and merged a fix that replaces the fatal assertions with recoverable error handling.
Impact is denial of service of the UPF. No confidentiality or integrity impact has been demonstrated. |
|---|
| Source | ⚠️ https://github.com/open5gs/open5gs/issues/4792 |
|---|
| User | ea1809 (UID 100625) |
|---|
| Submission | 09/22/2026 15:03 (1 month ago) |
|---|
| Moderation | 10/07/2026 13:27 (15 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 414968 [Open5GS up to 2.7.7 GTP-U Receive Path src/upf/gtp-path.c ogs_pfcp_xact_local_create allocation of resources] |
|---|
| Points | 20 |
|---|