F4Rs1Ght

**Name of the Vulnerable Software and Affected Versions** Open5GS version 2.7.2 **Description** The issue in Open5GS is related to the `ogs dbi auth info()` function in the `lib/dbi/subscription.c` file, which is associated with unlimited resource allocation. This can be exploited by a remote attacker to cause a denial of service. **Recommendations** For Open5GS version 2.7.2, consider disabling the `ogs dbi auth info()` function as a temporary workaround until a patch is available. Restrict access to the `lib/dbi/subscription.c` file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** UERANSIM versions prior to 3.2.6 **Description** The issue allows for an out-of-bounds read when a RLS packet is sent to gNodeB with a malformed PDU length. This occurs in the `readOctetString` function in src/utils/octet view.cpp and the `DecodeRlsMessage` function in src/lib/rls/rls pdu.cpp. **Recommendations** For versions prior to 3.2.6, update to version 3.2.6 or later to resolve the issue. As a temporary workaround, consider restricting the use of the `readOctetString` and `DecodeRlsMessage` functions until a patch is available.