Open5GS up to 2.7.5 AMF src/amf/npcf-build.c denial of service

Summaryinfo

A vulnerability, which was classified as problematic, has been found in Open5GS up to 2.7.5. This affects the function amf_npcf_am_policy_control_build_create/amf_nsmf_pdusession_build_create_sm_context of the file src/amf/npcf-build.c of the component AMF. This manipulation causes denial of service. This vulnerability is tracked as CVE-2025-8799. The attack is possible to be carried out remotely. Moreover, an exploit is present. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in Open5GS up to 2.7.5. It has been declared as problematic. Affected by this vulnerability is the function amf_npcf_am_policy_control_build_create/amf_nsmf_pdusession_build_create_sm_context of the file src/amf/npcf-build.c of the component AMF. The manipulation with an unknown input leads to a denial of service vulnerability. The CWE definition for the vulnerability is CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. As an impact it is known to affect availability.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2025-8799. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details and also a public exploit are known. The attack technique deployed by this issue is T1499 according to MITRE ATT&CK. The advisory points out:

The vulnerability in Open5GS AMF occurs when it receives a late ue-context-in-smf-data response from nudm-sdm after the associated gNB connection and RAN UE context have already been removed. In this scenario, the UE has no valid RAN association (Number of gNBs is now 0), but the AMF still attempts to process the SBI event. Because the UE’s ran_ue_id no longer exists, the ran_ue_find_by_id assertion fails in npcf-build.c, causing the AMF process to crash. This is a typical asynchronous race condition in which a delayed SBI response arrives after the UE context has been cleaned up, and due to missing state validation, the AMF hits an unhandled condition and aborts. The AMF (Access and Mobility Management Function) is a critical 5G core network function responsible for UE registration, mobility management, and coordination with the SMF for session control. An AMF crash disrupts control-plane operations, invalidates active UE contexts, and forces dependent network functions (e.g., SMF, UDM) into inconsistent or error states. The impact is not confined to the AMF process—it cascades across the core network, affecting registration, mobility, and session management services. Scope justification The current CVSS scoring lists Scope as “Unchanged” (S:U), suggesting the impact is limited to the AMF. However, in reality, an AMF crash caused by this flaw: Terminates ongoing signaling with SMF and other NFs. Causes loss of UE context across multiple network functions. Breaks both registration and session management for all connected and new UEs. This cross-component failure clearly extends beyond the AMF’s own security scope and therefore should be updated to “Changed” (S:C). Availability Impact justification Availability Impact is currently rated as “Low” (A:L), assuming partial service degradation. In practice, this vulnerability causes: Immediate loss of all active UE registrations — existing subscribers are detached due to UE context loss. Rejection of new registration requests — no new devices can join the network. Failure of periodic registration updates for existing UEs — leading to eventual service detachment. The outage persists until the AMF process is manually restarted. Given the AMF’s central role in mobility and registration services, this constitutes a complete denial of core network access, meeting the definition of “High” (A:H) availability impact.

It is possible to download the exploit at github.com. It is declared as proof-of-concept.

Upgrading to version 2.7.6 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch cf63dd63197bf61a4b041aa364ba6a6199ab15e4 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-24081). Additional details are provided at github.com. Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Name

• Open5GS

Version

• 2.7.0
• 2.7.1
• 2.7.2
• 2.7.3
• 2.7.4
• 2.7.5

License

• open-source

Website

• Product: https://github.com/open5gs/open5gs/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #626112: Open5GS <=v2.7.5 Denail of Service (by lixxxiang)

Be aware that VulDB is the high quality source for vulnerability data.

Discussion