Description

A security flaw has been discovered in Open5GS up to 2.7.7. Impacted is the function amf_namf_comm_handle_n1_n2_message_transfer of the file src/amf/namf-handler.c of the component N1-N2 Message Handler. Performing a manipulation of the argument N1N2MessageTransferReqData.n2InfoContainer.smInfo.n2InfoContent.ngapIeType results in denial of service. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 2.8.0 is recommended to address this issue. The patch is named abf8a836564b966b5141110fc25ed413c4f17522. It is advisable to upgrade the affected component.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-30T23:17:07.800Z",
  "pubdate": "2026-08-30T23:17:07.800Z",
  "executiveSummary": "A critical denial of service (DoS) vulnerability exists in the Open5GS Access and Mobility Management Function (AMF).\nThe flaw originates from improper input validation within the N1-N2 Message Handler, specifically involving the N1N2MessageTransferReqData structure.\nBy submitting a maliciously crafted N1N2MessageTransferReqData message, a remote, unauthenticated attacker can trigger a crash in the amf_namf_comm_handle_n1_n2_message_transfer function.\nThis vulnerability leads to the termination of the AMF service, disrupting 5G core network connectivity for user equipment (UE).\nThe vulnerability affects Open5GS versions up to 2.7.7. Given that exploit code is publicly available, the risk of exploitation in production environments is high.\nImmediate patching to version 2.8.0 or the application of the upstream commit abf8a836564b966b5141110fc25ed413c4f17522 is required to remediate the exposure.",
  "technicalDetails": "The vulnerability resides within the src/amf/namf-handler.c file in the AMF component of Open5GS. The root cause is an insecure handling of the N1N2MessageTransferReqData object during the N1-N2 message transfer procedure.\nSpecifically, the function amf_namf_comm_handle_n1_n2_message_transfer fails to adequately validate the ngapIeType field nested within the n2InfoContainer.smInfo.n2InfoContent path.\nThe attack flow initiates when a remote attacker sends a crafted N1-N2 Message Transfer request to the AMF via the Namf interface. The crafted request contains a manipulated ngapIeType value that does not align with the expected data types or constraints anticipated by the Open5GS N2 information processing logic.\nWhen the AMF processes this input, the unchecked or improperly sanitized value triggers a memory corruption, pointer dereference error, or an unhandled exception within the N2 processing logic. This behavior results in an immediate crash of the AMF process.\nBecause the AMF is a core control plane element in a 5G network, its sudden termination causes a catastrophic loss of service. All UEs connected through the impacted AMF are disconnected, and new registration attempts are rejected, effectively creating a persistent Denial of Service condition.\nThe vulnerability is exploitable remotely, does not require prior authentication or privileged access to the target system, and relies on the standard protocol communication path between network functions.\nThe presence of public exploit code lowers the barrier to entry for attackers, allowing for automated or manual exploitation by adversaries targeting 5G infrastructure. Remediation requires the implementation of robust bounds checking and input validation for the N2 information container structure to ensure that invalid or unexpected ngapIeType values are rejected gracefully before being processed by the internal handler.\nThe patch, identified as abf8a836564b966b5141110fc25ed413c4f17522, introduces the necessary validation logic to ensure the integrity of the N2 information container content, preventing the invalid input from reaching the vulnerable code execution path."
}