CVE-2026-108103 Details
Description
Open5GS through 2.8.0 contains a heap out-of-bounds read vulnerability in ogs_pfcp_parse_dropped_dl_traffic_threshold() that allows remote unauthenticated attackers to read past IE buffers via short IEs. Attackers can send PFCP Session Establishment or Modification Requests to the UPF on UDP port 8805 with DLPA and DLBY flags set, potentially crashing the UPF.
A heap out-of-bounds read vulnerability has been identified in Open5GS versions through 2.8.0. The issue resides in the function ogs_pfcp_parse_dropped_dl_traffic_threshold(), where the absence of proper length validation allows remote, unauthenticated attackers to read beyond the intended buffer limits of Information Elements (IEs). Exploitation involves sending PFCP Session Establishment or Modification Requests to the User Plane Function (UPF) over UDP port 8805, with the DLPA and DLBY flags activated. This vulnerability could lead to a crash of the UPF.
Users can upgrade to Open5GS version 2.8.1 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 9, 2026CISA-ADP
Assessed Oct 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Open5GS | <= 2.8.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 14, 2026 | CVE Modified | CISA-ADP |
| Oct 9, 2026 | New CVE Received | [email protected] |