CVE-2026-108105 Details
Description
Open5GS through 2.8.0 contains a reachable assertion vulnerability in mme_gn_handle_sgsn_context_request() that allows remote unauthenticated attackers to crash the MME via malformed SGSN Address IEs. Attackers sending GTPv1-C traffic from a configured SGSN address with a known UE IMSI or P-TMSI can supply an invalid address length to terminate open5gs-mmed, denying service to all subscribers.
A reachable assertion vulnerability has been identified in Open5GS versions through 2.8.0, specifically within the MME component. The vulnerability arises in the function 'mme_gn_handle_sgsn_context_request()', where the MME crashes due to an assertion failure triggered by malformed SGSN Address Information Elements (IEs) in GTPv1-C traffic. This exploitation allows remote, unauthenticated attackers to disrupt service for all connected subscribers by crashing the 'open5gs-mmed' process. The issue is caused by the MME's GTPv1 SGSN Context Request handler, which fails to properly validate the length of SGSN Address IEs before processing, leading to a denial-of-service condition.
Users can upgrade to Open5GS version 2.8.0 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 9, 2026CISA-ADP
Assessed Oct 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-617 | Reachable Assertion | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Open5GS | <= 2.7.5 (semver) <= 2.8.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 9, 2026 | CVE Modified | CISA-ADP |
| Oct 9, 2026 | New CVE Received | [email protected] |