CVE-2026-10113: Open5GS NF-Profile Parser Denial of Service Vulnerability

Technical summary

CVE-2026-10113 resides in the lib/sbi/nnrf-handler.c file within Open5GS's Shared NF-profile Parser, responsible for handling NF (Network Function) profile information in the 5G Service Based Interface (SBI). The vulnerability stems from improper validation of profile data (CWE-404: Improper Resource Validation), allowing authenticated remote attackers to craft malformed NF-profile messages that cause the parser to crash or enter an unresponsive state. The attack requires network-level access to the SBI and valid credentials, limiting the immediate threat surface but affecting any deployment that exposes the NF-profile endpoint to untrusted network segments.

Business impact

Organizations operating Open5GS-based 5G core networks face potential service interruptions if this vulnerability is exploited. Since 5G core components typically handle critical network routing and session management, a successful denial of service could disrupt mobile subscriber connectivity, impact network slicing operations, and cascade into service availability issues for downstream applications. Outages could affect emergency services, enterprise mobile services, and revenue-generating services, though the attack requires authenticated access, limiting opportunistic threat actors.

Affected systems

Open5GS versions up to and including 2.7.7 are confirmed vulnerable. The vulnerability is present in the SBI component's NF-profile handling, meaning any deployment using Open5GS with SBI interfaces and permitting authenticated remote connections is at risk. Specifically vulnerable components include the Network Repository Function (NRF) handler and any NF that exposes SBI endpoints. Verify your deployed version against the Open5GS release history to determine exposure.

Exploitability

This vulnerability carries a CVSS v3.1 score of 4.3 (MEDIUM severity) with a vector reflecting network accessibility, low attack complexity, and requirement for low-level authentication privileges. While the attack requires valid credentials (authenticated access), the network-attack vector and public availability of exploit information increase practical exploitability. The vulnerability is not currently tracked in the CISA Known Exploited Vulnerabilities (KEV) catalog, but public disclosure means active scanning and exploitation attempts are plausible within environments where attackers have already achieved authenticated access or compromised credentials.

Remediation

Upgrade Open5GS to a patched version released after version 2.7.7. Verify the exact patched version number in the official Open5GS security advisory and release notes. Additionally, implement network segmentation to restrict SBI access to trusted NF instances only, and enforce strict authentication controls to reduce the likelihood of credential compromise. Monitor for unexpected NF-profile parsing errors in logs.

Patch guidance

Contact the Open5GS project through its official repository (github.com/open5gs/open5gs) or security contacts to obtain the confirmed patched version number and release date. Apply patches in a staged manner, testing in a lab environment replicating your SBI topology before production deployment. If a production patch window is unavailable, consider isolating non-critical NF instances or implementing firewalls to restrict NF-profile endpoint access. Document your patching timeline and track completion across all Open5GS deployments in your environment.

Detection guidance

Monitor for repeated NF-profile parsing errors, application crashes, or NRF handler exceptions in Open5GS logs. Track connection patterns to the SBI endpoints; sudden spikes in failed authentication or malformed profile submission attempts may indicate reconnaissance or exploitation. Enable debug logging for the nnrf-handler component if available. Network-based detection should focus on identifying anomalous SBI message structures or oversized profile payloads. Correlate events with authentication logs to identify compromised service accounts attempting exploitation.

Why prioritize this

Although the CVSS score is MEDIUM (4.3) and the vulnerability requires authentication, the public availability of exploit information, combined with the critical nature of 5G core network availability, warrants prioritization for any organization operating Open5GS in production. Prioritize patching for any deployments where SBI endpoints are accessible from less-trusted segments (e.g., multi-tenant environments, federated networks). Environments with mature credential management and strong network segmentation can assign lower priority but should not defer indefinitely.

Risk score, explained

The CVSS score of 4.3 reflects the requirement for prior authentication (low privilege required) and the denial-of-service impact limited to availability (no confidentiality or integrity loss). However, the score does not fully capture the operational criticality of 5G core availability or the public exploit availability. In contexts where 5G service continuity is mission-critical, risk should be escalated; in lab or non-critical deployments, the inherent CVSS severity may be sufficient.

Frequently asked questions