Open5GS GTP-U Receive Path gtp-path.c ogs_pfcp_xact_local_create allocation of resources

published 2026-10-07 32 d ago modified 2026-10-07 32 d ago also EUVD-2026-94412

cvss: 5.3; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.6%; EPSS 0.6% chance of exploitation in 30 days, percentile 46%
public exploits: 0; none known

A weakness has been identified in Open5GS up to 2.7.7. This vulnerability affects the function ogs_pfcp_xact_local_create of the file src/upf/gtp-path.c of the component GTP-U Receive Path. This manipulation causes allocation of resources. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. Patch name: 9ffc252482d9b03ac01abcedbe95497ff4f95dd0. It is recommended to apply a patch to fix this issue.

Patch / fix

links 2

github.com/open5gs/open5gs@9ffc252 commit
github.com/open5gs/open5gs#4806 pull request

CISA SSVC

Exploitation: Proof of concept is public
Automatable: yes
Technical impact: partial
Assessed: 32 d ago (2026-10-07)

Exploit prediction

0.55% chance of exploitation in the next 30 days, higher than 46% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

github.com https://github.com/open5gs/open5gs/issues/4792 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	4.0	6.9	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
CNA	3.1	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C
CNA	3.0	5.3	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C
CNA	2.0	5.0	AV:N/AC:L/Au:N/C:N/I:N/A:P/E:POC/RL:OF/RC:C
CNA	4.0	5.5	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CNA	3.1	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CNA	2.0	5.0	AV:N/AC:L/Au:N/C:N/I:N/A:P

Affected products

n/a Open5GS

Classification

Weakness

CWE-770 Allocation of Resources Without Limits or Throttling
CWE-400 Uncontrolled Resource Consumption

References

github.com /open5gs/open5gs/pull/4806
issue-tracking, patch
github.com /open5gs/open5gs/commit/9ffc252482d9b03ac01abcedbe95497ff4f95dd0
patch
github.com /open5gs/open5gs/issues/4792
exploit, issue-tracking
vuldb.com /vuln/414968
vdb-entry, technical-description
vuldb.com /vuln/414968/cti
signature, permissions-required
vuldb.com /cve/CVE-2026-107166
third-party-advisory
vuldb.com /submit/994175
third-party-advisory
github.com /open5gs/open5gs/
product

Sources

CVE List CVE-2026-107166
NVD CVE-2026-107166

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary