PT-2026-36260 · Open5Gs · Open5Gs

Ziyulin

·

Published

2026-05-01

·

Updated

2026-05-01

·

CVE-2026-7518

CVSS v3.1

4.3

Medium

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Name of the Vulnerable Software and Affected Versions Open5GS versions prior to 2.7.8
Description A flaw in the AMF SBI Endpoint allows a remote attacker to cause a denial of service. The issue exists within the amf namf callback handle sdm data change notify() function, specifically affecting the "/namf-callback/v1/{id}/sdmsubscription-notify" endpoint. The problem is triggered by the manipulation of the changeItem.newValue argument.
Recommendations Update to a version later than 2.7.7. As a temporary workaround, restrict access to the "/namf-callback/v1/{id}/sdmsubscription-notify" endpoint to minimize the risk of exploitation.

Exploit

Fix

DoS

Improper Resource Release

Weakness Enumeration

CWE-404

Related Identifiers

CVE-2026-7518

Affected Products

Open5Gs