Open5GS up to 2.7.5 SMF src/smf/smf-sm.c smf_state_operational stream denial of service

Summaryinfo

A vulnerability was found in Open5GS up to 2.7.5 and classified as problematic. Affected by this vulnerability is the function smf_state_operational of the file src/smf/smf-sm.c of the component SMF. Executing a manipulation of the argument stream can lead to denial of service. This vulnerability is registered as CVE-2025-8802. It is possible to launch the attack remotely. Furthermore, an exploit is available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic was found in Open5GS up to 2.7.5. This vulnerability affects the function smf_state_operational of the file src/smf/smf-sm.c of the component SMF. The manipulation of the argument stream with an unknown input leads to a denial of service vulnerability. The CWE definition for the vulnerability is CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. As an impact it is known to affect availability.

The advisory is available at github.com. This vulnerability was named CVE-2025-8802. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Technical details and also a public exploit are known. This vulnerability is assigned to T1499 by the MITRE ATT&CK project. The advisory points out:

The vulnerability in Open5GS SMF occurs when handling a closed HTTP/2 stream during UE deregistration under memory-constrained conditions. Due to insufficient error handling, the SMF process triggers a fatal assertion (stream) in smf-sm.c, immediately terminating the entire SMF process. The SMF (Session Management Function) is a core network function responsible for PDU session establishment, modification, and release, as well as interfacing with the UPF (User Plane Function) and other network functions (e.g., AMF, UDM) over the service-based interface. An SMF crash disrupts active data sessions, breaks control signaling with the UPF, and forces dependent NFs into error states due to lost session context. The issue is not isolated to the SMF process—it cascades to other core functions, impacting the entire 5G core service. Scope justification The current CVSS scoring lists Scope as “Unchanged” (S:U), implying the impact remains confined to the SMF. In reality, an SMF crash causes a network-wide disruption of data-plane services. Active PDU sessions are dropped, UPF loses forwarding context, and AMF cannot complete session management procedures for both existing and new UEs. This cross-component failure clearly extends beyond the SMF’s own security scope, and therefore the Scope should be updated to “Changed” (S:C). Availability Impact justification Availability Impact is currently rated as “Low” (A:L), assuming partial service degradation. In practice, this vulnerability causes: Immediate termination of all active PDU sessions — all connected UEs lose data connectivity. Rejection of all new PDU session establishment requests — no new data services can be initiated. Failure of ongoing deregistration and session release procedures — leaving resources in inconsistent states. The outage persists until the SMF process is manually restarted. Given the SMF’s central role in session control and its dependencies across the core network, this meets the definition of “High” (A:H) availability impact, as it results in a complete denial of service for data connectivity across the network.

It is possible to download the exploit at github.com. It is declared as proof-of-concept.

Upgrading to version v2.7.6 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch f168f7586a4fa536cee95ae60ac437d997f15b97 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-24082). Additional details are provided at github.com. If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Name

• Open5GS

Version

• 2.7.0
• 2.7.1
• 2.7.2
• 2.7.3
• 2.7.4
• 2.7.5

License

• open-source

Website

• Product: https://github.com/open5gs/open5gs/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #626122: Open5GS <=v2.7.5 Denail of Service (by lixxxiang)

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion