Description

A reachable assertion vulnerability in the /nsmf-pdusession/v1/sm-contexts component of Open5GS v2.7.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted DELETE request.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-27T17:17:50.417Z",
  "pubdate": "2026-08-27T17:17:50.417Z",
  "executiveSummary": "A critical reachable assertion vulnerability has been identified in Open5GS v2.7.6 within the /nsmf-pdusession/v1/sm-contexts component. This vulnerability allows an unauthenticated or authenticated attacker to trigger a Denial of Service (DoS) condition by submitting a specifically crafted DELETE request to the vulnerable endpoint.\nThe flaw stems from improper input validation or state handling within the Session Management (SM) context lifecycle, resulting in an assertion failure that forces the immediate termination of the Open5GS service process. This impact effectively renders the affected 5G core network function unavailable, disrupting PDU session management and service connectivity for all downstream user equipment (UE).\nGiven the nature of the vulnerability, it presents a significant availability risk to critical telecommunications infrastructure. Exploitation requires minimal interaction, as the attacker only needs the capability to reach the SMF (Session Management Function) interface via the specified RESTful API path. Organizations running Open5GS v2.7.6 are highly encouraged to monitor traffic to this endpoint for anomalous DELETE requests and restrict network exposure of the management interfaces to trusted entities only.",
  "technicalDetails": "The vulnerability resides in the processing logic for DELETE requests directed at the /nsmf-pdusession/v1/sm-contexts path, which is managed by the Open5GS Session Management Function (SMF). An assertion vulnerability occurs when the software makes an assumption about the state of a PDU session context that is invalidated by a malformed or out-of-sequence DELETE request.\nIn the Open5GS architecture, the SMF tracks session states using internal data structures. When a DELETE request is received, the system attempts to look up the associated context identified in the URL path. If the crafted request bypasses standard validation checks—for instance, by providing a session identifier that exists in the database but is in an unexpected state, or by providing non-conforming JSON payloads—the code execution path reaches an assertion statement intended to catch logical inconsistencies during development.\nThe attack flow proceeds as follows: 1) The attacker identifies the target SMF service endpoint, specifically the /nsmf-pdusession/v1/sm-contexts resource. 2) The attacker constructs a HTTP DELETE request targeting a specific, potentially valid or arbitrary, SM context ID. 3) The request payload or URI parameters are manipulated to trigger an inconsistency between the internal state machine of the SMF and the input provided. 4) Upon processing the request, the internal function performs a sanity check via an assertion. When the assertion fails, the Open5GS SMF process invokes an abort signal, leading to an immediate termination of the process and a subsequent Denial of Service.\nThe root cause is the reliance on programmatic assertions for error handling in a production-facing network component. Assertions are typically designed to abort execution when a programmer-defined condition is unmet, serving as a debugging tool rather than a robust error-handling mechanism for untrusted input. By providing a crafted DELETE request, an attacker forces the application into an 'impossible' state, causing the process to crash.\nBecause the service termination is synchronous and impacts the core thread handling SMF requests, the service remains unavailable until an external watchdog or administrator manually restarts the process. This vulnerability is particularly potent because it does not require complex memory corruption techniques, such as buffer overflows or heap spraying; it simply exploits the inherent design flaw of using assertions to validate external network requests. This vulnerability affects all deployments of Open5GS v2.7.6 that expose the SMF API to reachable network segments."
}