CVE-2026-8187 Details

A resource consumption vulnerability has been identified in Open5GS versions prior to 2.7.7, specifically within the User Plane Function (UPF) component. The issue arises in the GTPv1-U receive callback function, where improper handling of GTP-U Echo Requests and G-PDUs with invalid or unknown TEIDs can lead to significant user-plane performance degradation. This vulnerability allows for latency inflation and increased packet loss on legitimate traffic, creating a disruptive impact on timely data and control flows. The problem can be exploited remotely by sending a sustained stream of abusive GTP-U traffic to the UPF endpoint, interleaving Echo Requests with G-PDUs referencing invalid TEIDs, which triggers a resource-intensive error-handling process on the hot path of the data stream.