CVE-2026-10116: Open5GS UE Authentication Denial-of-Service Vulnerability

Technical summary

CVE-2026-10116 is a denial-of-service vulnerability in Open5GS versions up to 2.7.7, stemming from improper resource handling in the ogs_sbi_xact_add function within /lib/core/ogs-timer.c. The vulnerability affects the ue-authentications endpoint and is classified under CWE-404 (Uninitialized Variable). The flaw allows an authenticated attacker to manipulate transaction state, causing the service to become unresponsive. The CVSS 3.1 score of 4.3 (MEDIUM) reflects the network-accessible attack vector, low attack complexity, and requirement for authenticated access, with impact limited to availability.

Business impact

Exploitation of this vulnerability can disrupt 5G authentication services, preventing legitimate user authentication and registration on affected networks. While not directly exposing confidential data or enabling privilege escalation, sustained denial-of-service attacks could degrade network availability and user experience. Organizations relying on Open5GS for non-critical test or secondary networks face the most immediate operational risk, though any production deployment warrants prompt attention given the availability of public exploit code.

Affected systems

Open5GS versions through 2.7.7 are affected. This vulnerability impacts deployments of the open-source 5G core network software used in research, testing, and production environments. Organizations should identify all instances of Open5GS in their infrastructure and verify installed version numbers against the affected range.

Exploitability

The vulnerability requires authenticated access to the UE authentication endpoint, which moderates overall exploitability in internet-facing scenarios but significantly increases risk in internal networks or test environments where authentication credentials may be less strictly controlled. Public exploit code availability lowers the barrier to weaponization. Remote exploitation is feasible without user interaction, making it a practical concern for environments with permissive network access controls.

Remediation

Organizations should upgrade Open5GS to a patched version beyond 2.7.7. Verify the specific patch version against the official Open5GS project advisories and release notes to confirm vulnerability closure. Until patching is possible, consider implementing network-level access controls to restrict access to the ue-authentications endpoint to trusted sources only.

Patch guidance

Consult the Open5GS project repository and official security advisories for the specific patch version addressing CVE-2026-10116. Upgrade the affected Open5GS installation following the project's documented update procedures. Validate the upgrade by confirming the new version number and, where feasible, conducting functional testing of authentication endpoints in a non-production environment before full deployment.

Detection guidance

Monitor logs from Open5GS for repeated failed or malformed UE authentication requests, particularly from single sources or with suspicious patterns. Watch for timer-related errors or transaction timeouts in system logs. Network intrusion detection systems configured to identify denial-of-service patterns may help surface abuse attempts. Endpoint availability monitoring should alert on unexpected service degradation or restarts of authentication processes.

Why prioritize this

Although the CVSS score of 4.3 is moderate, prioritize patching based on your specific Open5GS deployment context. Public exploit availability and the ease of remote exploitation (authenticated) mean that opportunistic attackers may target known vulnerable instances. Prioritize production deployments and internet-facing instances highest; internal test environments can follow with a longer timeline if patching requires maintenance windows.

Risk score, explained

The CVSS 3.1 score of 4.3 reflects a network-accessible, low-complexity attack requiring valid authentication credentials. Impact is limited to service availability (no data breach or lateral movement risk). The score would be lower if authentication were not required, but higher in environments where the authentication endpoint is exposed to a broad set of trusted users or where availability is mission-critical.

Frequently asked questions