A denial-of-service vulnerability exists in open5GS v2.8.0 in the PFCP transaction handling path.
Affects Open5GS v2.8.0 when the PFCP transaction or timer resource pool is exhausted. The checked facts list no fix.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- No fix listed
- Who is exposed
- Not reported
Do first: Workaround: The checked facts list no fix and no workaround. The impact is a process crash, and the facts say service resumes once the SMF or UPF component is restarted.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- Published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 8/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Unclear
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Open5GS, an open-source 5G core network implementation, is affected by this flaw in its PFCP transaction handling (used by the SMF and UPF components). An attacker who can send crafted PFCP messages can exhaust transaction resources and crash the affected process, disrupting service and blocking new session establishment until the component is restarted.
Read the original description
A denial-of-service vulnerability exists in open5GS v2.8.0 in the PFCP transaction handling path. When the PFCP transaction or timer resource pool is exhausted, ogs_pfcp_xact_remote_create() returns NULL, but the failure is not handled properly and leads to an ogs_assert(new) failure in ogs_pfcp_xact_receive(). An attacker able to send PFCP messages to the affected SMF/UPF can exhaust transaction resources and cause the network function process to terminate with SIGABRT, resulting in service disruption and preventing further session establishment until the affected component is restarted.
What to do
Workaround: The checked facts list no fix and no workaround. The impact is a process crash, and the facts say service resumes once the SMF or UPF component is restarted.
Timeline
- CVE published
- Record last updated
- First seen by cve.now
Evidence 3
- Repository
- Repository
- Link
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-106807
What does this mean?
The PFCP transaction handling path in Open5GS v2.8.0 has a denial-of-service flaw. When the PFCP transaction or timer resource pool is exhausted, the SMF or UPF process terminates with SIGABRT, disrupting service until the component is restarted.Source: gist.github.com, github.com
Am I affected, and how do I check?
Open5GS v2.8.0 is the affected version, and the crash requires the PFCP transaction or timer resource pool to be exhausted. To check a installed version, look at the Open5GS version reported by the installed package or binary.Source: gist.github.com, github.com
What should I do about it?
The checked facts name no fixed version and no workaround. Check the upstream Open5GS advisory for a fixed release before deciding what to change.Source: gist.github.com, github.com
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What if there's no patch?
The checked facts list no fix and no workaround. The impact is a process crash, and the facts say service resumes once the SMF or UPF component is restarted.Source: gist.github.com, github.com