CVE-2026-106806 Details
Description
A memory exhaustion issue exists in Open5GS v2.8.0 in the HTTP/2 SBI server. Repeated header names cause previously allocated header strings to be leaked, and HPACK compression allows an unauthenticated remote attacker to trigger tens of thousands of duplicate headers with a small request. Repeated crafted requests can cause persistent heap growth, exhaust process memory, and terminate the affected Open5GS network function, resulting in denial of service.
A memory exhaustion vulnerability has been identified in Open5GS version 2.8.0, specifically within the HTTP/2 Service-Based Interface (SBI) server. This issue arises when the server processes HTTP/2 requests that contain repeated header names. The server fails to properly release previously allocated header strings, causing memory leaks. Exploiting HPACK header compression, an unauthenticated remote attacker can send a small request that triggers the processing of tens of thousands of duplicate headers. This exploitation leads to persistent heap memory growth, exhausting available process memory and causing the termination of the affected Open5GS network function. As a result, this vulnerability creates a denial-of-service condition. The issue impacts multiple network functions within Open5GS, including the Network Repository Function (NRF), Session Management Function (SMF), and Unified Data Management (UDM).
Users can update to Open5GS version 2.8.1, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 2, 2026CISA-ADP
Assessed Nov 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/open5gs/open5gs/issues/4788 | CISA-ADP | ExploitIssue TrackingTechnical DescriptionVendor |
| https://gist.github.com/hackeryounow/c923fad9de83011004bd7d078b817dc0 | [email protected] | Technical Description |
| https://github.com/open5gs/open5gs/commit/76f15375ead1b2db09193458e56640da0a86c255 | [email protected] | Source CodeVendor |
| https://github.com/open5gs/open5gs/issues/4788 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| Open5GS | v2.8.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 5, 2026 | CVE Modified | CISA-ADP |
| Nov 2, 2026 | New CVE Received | [email protected] |