Description

A reachable assertion vulnerability in the NUDM-UECM interface of Open5GS v2.7.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted DELETE request.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-27T17:17:50.303Z",
  "pubdate": "2026-08-27T17:17:50.303Z",
  "executiveSummary": "A reachable assertion vulnerability exists within the NUDM-UECM (Unified Data Management - UE Context Management) interface of Open5GS version 2.7.6.\nThe vulnerability is classified as a Denial of Service (DoS) condition triggered by improper input validation of incoming HTTP DELETE requests.\nBy submitting a maliciously crafted request to the NUDM service, an attacker can force the application to trigger a runtime assertion failure.\nThis assertion failure causes an immediate and abnormal termination of the process, resulting in service unavailability.\nThe impact is significant, as it disrupts core network signaling operations, preventing User Equipment (UE) registration or context management tasks.\nExploitation requires network reachability to the NUDM service interface.\nThis vulnerability highlights a critical lack of robust error handling for malformed protocol requests, which can be leveraged to destabilize the core network infrastructure.",
  "technicalDetails": "The vulnerability resides in the processing logic of the NUDM-UECM interface within Open5GS v2.7.6, specifically where DELETE requests are parsed and handled.\nThe root cause is an insecure assertion implementation that assumes a specific state or data structure integrity upon receiving a request, failing to account for malformed or unexpected payloads.\nWhen the NUDM service receives a crafted DELETE request, the internal logic fails to validate the parameters or the state of the UE context appropriately before proceeding with the operation.\nThe application invokes a standard library assertion (such as assert()) on an input-dependent condition. If the crafted request forces the logic into an inconsistent or undefined state, the assertion evaluates to false.\nUpon evaluation failure, the program aborts execution to prevent memory corruption or further unpredictable behavior, effectively crashing the NUDM process.\nThe attack flow follows a clear sequence: 1) The attacker initiates a connection to the NUDM service via the RESTful interface. 2) The attacker transmits a specifically crafted HTTP DELETE request targeting a UE context. 3) The NUDM component processes the request header or body, triggering the vulnerable assertion branch.\nBecause the NUDM process is critical for UE context lifecycle management, the process termination leads to a full DoS condition for that specific network function.\nThe vulnerability is reachable via standard network exposure of the NUDM interface; however, it does not necessarily require prior authentication if the endpoint is exposed, as the assertion failure can occur during initial request parsing or lookup phases.\nThis vulnerability is particularly severe in 5G core deployments where high availability is paramount, as the crashing process interrupts the signaling plane for all associated subscribers managed by that specific NUDM instance."
}