CVE-2026-10117: Open5GS nghttp2-server Denial of Service Vulnerability

Technical summary

CVE-2026-10117 is a resource exhaustion vulnerability in the ogs_pool_id_calloc function within Open5GS's nghttp2-server.c library. The vulnerability stems from improper handling of pool ID allocation (CWE-404), allowing an authenticated attacker to manipulate the allocation logic and exhaust system resources. The flaw permits remote exploitation with low attack complexity, though prior authentication is required. The vulnerability resides in a critical network interface component responsible for SBI (Service Based Interface) communication in 5G architectures.

Business impact

For organizations operating 5G core networks using Open5GS, this vulnerability poses a service availability risk. A denial of service attack could disrupt SBI communication between network functions, degrading voice, data, and messaging services. While the attack requires authentication and the impact is limited to availability (not confidentiality or integrity), the public availability of exploit code means threat actors may repurpose it quickly. Downtime in telecom infrastructure can translate to revenue loss, regulatory reporting obligations, and reputational damage.

Affected systems

Open5GS versions up to and including 2.7.7 are vulnerable. The vulnerability specifically affects the nghttp2-server component used for HTTP/2 communication within the SBI framework. Organizations using Open5GS in production 5G deployments, lab environments, or hybrid architectures should audit their deployed versions immediately.

Exploitability

The vulnerability requires an attacker to have valid authentication credentials to trigger the issue, which moderates the attack surface. However, the low attack complexity and network-accessible nature of the SBI interface mean that a compromised user account or insider threat could weaponize this flaw with minimal difficulty. The public release of exploit code lowers the technical barrier for opportunistic threat actors. External attackers without credentials cannot directly exploit this vulnerability.

Remediation

Upgrade Open5GS to a patched version released after 2.7.7. Verify the exact version number and release notes from the Open5GS project repository. Organizations unable to patch immediately should restrict network access to the SBI interface through firewall rules, VPNs, or network segmentation, allowing communication only from trusted network functions. Monitor for suspicious authentication attempts and consider implementing rate limiting on the affected endpoints.

Patch guidance

Check the Open5GS GitHub repository and official release notes for versions after 2.7.7 that address the ogs_pool_id_calloc issue. Apply the patch in a controlled manner, first to lab or staging environments that mirror production topology. Validate HTTP/2 SBI communication between network functions post-patch. If running Open5GS in a containerized environment, rebuild container images with the patched version and redeploy. For air-gapped deployments, obtain the patched source code through secure channels and follow your standard build and testing procedures.

Detection guidance

Monitor Open5GS logs for repeated allocation failures or pool exhaustion errors originating from the nghttp2-server component. Watch for unusual patterns of SBI requests from authenticated users—specifically requests that trigger resource-intensive pool operations. Implement network-level monitoring to detect abnormal traffic volume or connection patterns on SBI ports (typically 7777 for insecure communication or port 443 for secure interfaces). Alert on failed authentication attempts followed by successful logins that precede denial of service symptoms, as this may indicate a compromised credential being used.

Why prioritize this

Although the CVSS score of 4.3 (Medium) reflects limited blast radius due to authentication requirements and availability-only impact, the public exploit availability and the critical nature of SBI communication in 5G infrastructure elevate the practical urgency. SBI disruptions cascade quickly through the core network, and any extended outage affects end-user services. Prioritize patching based on whether your Open5GS instance is internet-facing, the authentication model in use, and the tolerance for SBI downtime. Production deployments in critical telecom environments warrant faster remediation timelines than isolated test systems.

Risk score, explained

The CVSS 3.1 score of 4.3 reflects: (1) network-accessible attack vector reducing friction; (2) low attack complexity once authenticated; (3) required prior authentication narrowing exposure; (4) no impact to confidentiality or integrity; and (5) limited availability impact per instance. However, the contextual severity is higher given the infrastructure role of 5G core networks, the availability of public exploit code, and the potential for cascading failures in SBI-dependent functions. Use this score as a baseline; adjust prioritization upward if your deployment has permissive authentication or if SBI availability is mission-critical.

Frequently asked questions