Description

A security vulnerability has been detected in Open5GS 2.8.0. Affected by this issue is the function hss_ogs_diam_s6a_air_cb of the file src/hss/hss-s6a-path.c of the component S6a Authentication-Information-Request Handler. Such manipulation of the argument Visited-PLMN-Id leads to heap-based buffer overflow. The attack may be performed from remote. The name of the patch is a9c82ee0b590d76a581b0580cb46b598984e2392. A patch should be applied to remediate this issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.4",
  "pubDate": "2026-08-24T00:16:47.367Z",
  "pubdate": "2026-08-24T00:16:47.367Z",
  "executiveSummary": "A critical security vulnerability has been identified in Open5GS version 2.8.0, specifically within the S6a Authentication-Information-Request Handler component.\nThe vulnerability is classified as a heap-based buffer overflow, stemming from improper handling of the Visited-PLMN-Id argument during Diameter protocol message processing.\nAn unauthenticated remote attacker can exploit this flaw by manipulating the Visited-PLMN-Id parameter, potentially leading to memory corruption, denial of service, or arbitrary code execution within the context of the affected daemon.\nThe risk implications are severe due to the remote attack vector and the core network exposure of the HSS (Home Subscriber Server) component in 4G/5G mobile core deployments.\nSuccessful exploitation requires the ability to send specially crafted Diameter S6a signaling messages to the vulnerable Open5GS endpoint over the network.\nImmediate remediation is required through the application of the official vendor patch referenced by commit hash a9c82ee0b590d76a581b0580cb46b598984e2392.",
  "technicalDetails": "The vulnerability resides in the function hss_ogs_diam_s6a_air_cb located within the source file src/hss/hss-s6a-path.c of the Open5GS S6a Authentication-Information-Request Handler component.\nThe root cause of the heap-based buffer overflow is the lack of proper bounds checking and input validation on the Visited-PLMN-Id argument received within incoming Diameter S6a Authentication-Information-Request (AIR) messages.\nWhen the HSS processes the Diameter message, the parsing logic copies or writes the supplied Visited-PLMN-Id data into a dynamically allocated heap buffer without appropriately verifying that the input size matches the destination buffer capacity.\nAttack flow begins with a remote threat actor transmitting a malicious Diameter S6a AIR message containing an oversized or malformed Visited-PLMN-Id Attribute Value Pair (AVP).\nUpon receipt, the vulnerable hss_ogs_diam_s6a_air_cb function parses the payload and attempts to store the excessive data into the fixed or improperly sized heap buffer.\nThis operation results in a heap-based buffer overflow, overwriting adjacent heap metadata or critical application data structures.\nNetwork exposure is high, as the S6a interface is exposed to neighboring core network elements or roaming partners, depending on network architecture and perimeter security controls.\nAuthentication and privilege requirements for this attack depend on network placement, but remote exploitation is feasible if the attacker can inject traffic across the S6a interface or leverage an intermediary node.\nThe post-exploitation impact includes application crashes leading to a denial of service (DoS) of the HSS service, or potentially arbitrary code execution if heap layout manipulation and payload craftiness permit control flow hijacking.\nAffected versions explicitly include Open5GS 2.8.0, and the vulnerable execution path is constrained to the S6a protocol handling routines."
}