PT-2026-8238 · Open5Gs · Open5Gs

Linziyu · Published 2026-01-13 · Updated 2026-02-18 · CVE-2026-2517

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Open5GS versions 2.7.0 through 2.7.6

Description A security issue exists in Open5GS that can lead to a denial of service. The issue is related to the ogs gtp2 parse tft function within the lib/gtp/v2/types.c library of the SMF component. Manipulating the pf[0].content.length argument can cause the service to crash. The issue is remotely exploitable and an exploit has been publicly released.

Recommendations Open5GS versions 2.7.0 through 2.7.6 are affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Improper Resource Release

Weakness Enumeration

CWE-404

Related Identifiers

BDU:2026-02317

CVE-2026-2517

Affected Products

Open5Gs

References · 16

• 🔥 https://github.com/open5gs/open5gs/issues/4281#issue-3807802287 · Exploit
• https://github.com/open5gs/open5gs/issues/4281 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-02317 · Security Note
• https://osv.dev/vulnerability/CVE-2026-2517 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-2517 · Security Note
• https://vuldb.com/?submit.738332 · Note
• https://t.me/cveNotify/152059 · Telegram Post
• https://twitter.com/offseq/status/2023042160228958484 · Twitter Post
• https://t.me/CVEtracker/44760 · Telegram Post
• https://vuldb.com/?id.346108 · Note
• https://twitter.com/vuldb/status/2023058364130087350 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2023026933995299288 · Twitter Post
• https://t.me/cveNotify/152427 · Telegram Post
• https://vuldb.com/?ctiid.346108 · Note
• https://github.com/open5gs/open5gs · Note