Description

A vulnerability has been found in Open5GS up to 2.7.6. Affected by this issue is the function fd_msg_sess_get of the component HSS Service. Such manipulation of the argument Session-Id leads to denial of service. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The project locked and limited conversation to collaborators.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-12T03:16:42.600Z",
  "pubdate": "2026-08-12T03:16:42.600Z",
  "executiveSummary": "A denial of service vulnerability has been identified in Open5GS up to version 2.7.6, specifically within the HSS Service component. The flaw arises from improper handling of the Session-Id argument within the fd_msg_sess_get function. Successful exploitation of this vulnerability allows remote attackers to trigger a denial of service condition, disrupting core network operations. The risk implications are severe due to the potential interruption of authentication, authorization, and subscriber management services in 5G core deployments. The attack can be executed remotely over the network without requiring prior authentication or elevated privileges. Public disclosure of the exploit increases the likelihood of active targeting, necessitating immediate defensive countermeasures and adherence to vendor remediation guidance.",
  "technicalDetails": "The vulnerability resides in the HSS Service component of Open5GS, specifically inside the fd_msg_sess_get function responsible for parsing and managing Diameter session states based on the Session-Id attribute-value pair (AVP). The root cause stems from insufficient validation, bounds checking, or error handling when processing the Session-Id argument supplied in incoming Diameter signaling messages. When a maliciously crafted or malformed Session-Id is processed by fd_msg_sess_get, it triggers an unhandled exception, null pointer dereference, or memory corruption condition that abruptly terminates the affected process.\nThe attack flow begins with a remote attacker sending a crafted Diameter message containing the manipulated Session-Id argument directly to the exposed network interfaces of the HSS Service. Because the service lacks adequate input sanitization within the vulnerable function, the malformed argument bypasses initial sanity checks and reaches the core parsing logic. Upon processing the malicious payload, the application crashes, resulting in an immediate denial of service for the HSS component. Affected versions include Open5GS up to 2.7.6. The attack vector is entirely network-based, enabling remote exploitation without authentication or privilege requirements, thereby severely impacting the availability and resilience of the affected telecommunications infrastructure."
}