Open5GS PFCP Session Report Request n4-handler.c smf_n4_handle_session_report_request assertion

published 2026-09-16 53 d ago modified 2026-09-17 53 d ago also EUVD-2026-80934

cvss: 4.3; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.5%; EPSS 0.5% chance of exploitation in 30 days, percentile 45%
public exploits: 0; none known

A vulnerability has been found in Open5GS up to 2.8.0. Affected by this issue is the function smf_n4_handle_session_report_request of the file src/smf/n4-handler.c of the component PFCP Session Report Request Handler. The manipulation leads to reachable assertion. The attack may be initiated remotely. The identifier of the patch is e5f0c06d0f2d9613b003daa1cfa3ba8a4bd157e9. It is suggested to install a patch to address this issue.

Patch / fix

links 1

github.com/open5gs/open5gs@e5f0c06 commit

CISA SSVC

Exploitation: Proof of concept is public
Automatable: no
Technical impact: partial
Assessed: 53 d ago (2026-09-17)

Exploit prediction

0.53% chance of exploitation in the next 30 days, higher than 45% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

github.com https://github.com/open5gs/open5gs/issues/4744 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	4.0	5.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X
CNA	3.1	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C
CNA	3.0	4.3	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C
CNA	2.0	4.0	AV:N/AC:L/Au:S/C:N/I:N/A:P/E:ND/RL:OF/RC:C
CNA	4.0	5.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CNA	3.1	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CNA	2.0	4.0	AV:N/AC:L/Au:S/C:N/I:N/A:P

Affected products

n/a Open5GS

Classification

Weakness

CWE-617 Reachable Assertion

References

github.com /open5gs/open5gs/commit/e5f0c06d0f2d9613b003daa1cfa3ba8a4bd157e9
patch
github.com /open5gs/open5gs/issues/4744
issue-tracking, exploit
vuldb.com /vuln/405594
vdb-entry, technical-description
vuldb.com /vuln/405594/cti
signature, permissions-required
vuldb.com /cve/CVE-2026-92416
third-party-advisory
vuldb.com /submit/940464
third-party-advisory
github.com /open5gs/open5gs/
product

Sources

CVE List CVE-2026-92416
NVD CVE-2026-92416

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary