Description

A vulnerability was found in Open5GS up to 2.7.1. This affects the function hss_ogs_diam_s6a_air_cb/hss_ogs_diam_s6a_ulr_cb of the file src/hss/hss-s6a-path.c of the component Diameter S6a Interface. Performing a manipulation of the argument os.len results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been made public and could be used. Upgrading to version 2.7.2 is able to mitigate this issue. The patch is named e89aa79efe629ae90f59dcdf8847c117d9a7da86. It is suggested to upgrade the affected component.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-11T20:17:22.067Z",
  "pubdate": "2026-08-11T20:17:22.067Z",
  "executiveSummary": "A stack-based buffer overflow vulnerability has been identified in Open5GS up to version 2.7.1, specifically within the Diameter S6a interface component. The flaw exists in the functions hss_ogs_diam_s6a_air_cb and hss_ogs_diam_s6a_ulr_cb located within the source file src/hss/hss-s6a-path.c.\nThe vulnerability allows remote attackers to trigger a stack-based buffer overflow by manipulating the argument os.len. Successful exploitation of this security defect can lead to memory corruption, potentially allowing remote code execution, denial of service, or compromise of the Home Subscriber Server (HSS) component.\nThe attack can be initiated remotely without requiring authentication or prior system privileges, increasing the overall risk profile due to the exposure of the Diameter S6a interface. A public exploit is available, making active exploitation a critical concern for deployments running vulnerable versions.\nOrganizations utilizing Open5GS are strongly advised to upgrade to version 2.7.2 or apply the official patch identified by commit hash e89aa79efe629ae90f59dcdf8847c117d9a7da86 to mitigate the risks associated with this vulnerability.",
  "technicalDetails": "The vulnerability is a stack-based buffer overflow residing in the Diameter S6a interface handling routines of Open5GS. Specifically, the vulnerable code paths are localized within the hss_ogs_diam_s6a_air_cb and hss_ogs_diam_s6a_ulr_cb functions inside the src/hss/hss-s6a-path.c source file.\nThe root cause of the vulnerability stems from improper bounds checking or unsafe memory copy operations involving the os.len argument within Diameter protocol message parsing or callback processing. When handling incoming S6a messages such as Authentication Information Request (AIR) or Update Location Request (ULR), the application processes the length parameter provided in the os structure.\nIf an attacker supplies a crafted os.len value that exceeds the allocated size of the destination stack buffer, copying data into the buffer results in a stack-based buffer overflow. This memory corruption overwrites adjacent stack frames, including saved return addresses and frame pointers.\nThe attack vector is network-based, leveraging the remote exposure of the Diameter S6a interface. An unauthenticated remote attacker can send malicious or malformed Diameter S6a signaling messages to the HSS component. Upon receiving the payload, the HSS executes the vulnerable callback functions, parsing the attacker-controlled os.len argument and triggering the overflow.\nThe impact of successful exploitation includes potential remote code execution under the security context of the Open5GS HSS process, or application crashes leading to a denial of service condition. Given the availability of public exploits, attackers can automate the delivery of the malicious payload to target vulnerable instances directly."
}