CVE-2026-108102 Details
Description
Open5GS through 2.8.0 contains a heap out-of-bounds read vulnerability in ogs_pfcp_parse_volume_measurement() in lib/pfcp/types.c that allows remote unauthenticated attackers to read past IE buffers. Attackers can send a PFCP Session Report Request to the SMF on UDP port 8805 with a short, all-flags Volume Measurement IE, reading up to 48 bytes and potentially crashing the SMF.
A heap out-of-bounds read vulnerability has been identified in Open5GS versions through 2.8.0. The issue resides in the PFCP Volume Measurement Information Element (IE) parser within the file 'lib/pfcp/types.c'. This vulnerability allows remote, unauthenticated attackers to read beyond the boundaries of IE buffers. By sending a crafted PFCP Session Report Request over UDP port 8805 to the SMF, attackers can exploit this vulnerability. The crafted request must include a short Volume Measurement IE with all flags set, which leads to reading up to 48 bytes of adjacent memory. This out-of-bounds read can potentially crash the SMF.
Users can upgrade to Open5GS version 2.8.0 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 9, 2026CISA-ADP
Assessed Oct 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Open5GS | <= 2.7.5 (semver) <= 2.8.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 9, 2026 | New CVE Received | [email protected] |
| Oct 9, 2026 | CVE Modified | CISA-ADP |