Description

A vulnerability was detected in Open5GS up to 2.7.6. Affected is the function diam_log_func of the file lib/diameter/common/init.c of the component CER Handler. The manipulation results in reachable assertion. The attack can be executed remotely. The exploit is now public and may be used. Upgrading to version 2.7.7 is able to address this issue. The patch is identified as c1a803516a3c0485696cb9bcca7a80ad857c7383. It is advisable to upgrade the affected component.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-12T03:16:41.210Z",
  "pubdate": "2026-08-12T03:16:41.210Z",
  "executiveSummary": "An assertion failure vulnerability exists in Open5GS up to version 2.7.6, specifically within the CER Handler component responsible for processing Diameter Capabilities-Exchange-Request messages.\nThe vulnerability is triggered via the diam_log_func function located in lib/diameter/common/init.c.\nRemote attackers can exploit this flaw by manipulating input parameters to induce a reachable assertion, resulting in a denial of service condition due to abnormal application termination.\nThe risk implication is high for availability, as the core 5G core network functions relying on Open5GS may crash upon receiving malformed or maliciously crafted Diameter signaling traffic.\nNo specific authentication or high-level privileges are required to launch the attack, provided the target component is network-accessible and processing remote Diameter connections.\nPublic exploits are currently available, increasing the urgency for defensive action.\nUpgrading the affected software to version 2.7.7 permanently resolves the issue by applying the vendor-supplied patch.",
  "technicalDetails": "The vulnerability resides in the Diameter CER Handler component of Open5GS, specifically inside the diam_log_func function implemented within the source file lib/diameter/common/init.c.\nOpen5GS versions up to 2.7.6 fail to properly validate or sanitize specific fields or states during the handling of incoming Diameter protocol exchanges, such as Capabilities-Exchange-Request (CER) messages.\nThe root cause is an overly strict or improperly guarded assertion within the logging or initialization logic of the Diameter subsystem. When an attacker sends a maliciously crafted remote request containing unexpected data structures or attribute-value pairs, the application evaluates an assertion condition that evaluates to false.\nUpon encountering this unexpected state, the program executes an explicit assertion failure, causing the immediate termination of the process.\nThe attack flow proceeds as follows: First, a remote attacker establishes or utilizes an existing network connection to the Diameter service exposed by the Open5GS component. Second, the attacker transmits a specially crafted Diameter packet designed to interact with the vulnerable CER parsing and logging mechanisms. Third, the diam_log_func function processes the input, encounters the anomalous data, and triggers the reachable assertion. Finally, the Open5GS process crashes, leading to a denial of service for dependent 5G control plane operations.\nNetwork exposure is present wherever the Diameter interface is reachable by untrusted peers or external networks without adequate boundary protection. Exploitation does not require prior authentication or elevated privileges, as the crash occurs during the initial protocol handshake phases.\nPost-exploitation impact is limited to denial of service, as arbitrary code execution is not indicated by the nature of an assertion failure vulnerability, though recurring crashes disrupt core network availability."
}