CVE-2026-14618: Open5GS AMF Denial of Service via NF Discovery Handler

Technical summary

CVE-2026-14618 involves improper exception or error handling in the amf_nnrf_handle_nf_discover function within src/amf/nnrf-handler.c of Open5GS. The vulnerability is classified under CWE-404 (Improper Resource Validation). The flaw allows an authenticated remote attacker to send crafted NF Discovery (Network Function Discovery) requests that trigger an unhandled condition, leading to denial of service. The attack requires valid credentials (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L), indicating a low bar for authenticated access in 5G network deployments where service-to-service communication is common.

Business impact

For operators and enterprises running Open5GS as a core network component, successful exploitation results in AMF service unavailability. The AMF is critical for user authentication, authorization, and session management in 5G networks. Disruption can prevent legitimate subscribers from establishing new sessions or maintaining connectivity. This creates both immediate service disruption and potential revenue loss in carrier environments, and operational chaos in private 5G deployments used by enterprise campuses or industrial sites.

Affected systems

Open5GS versions 2.7.7 and earlier are vulnerable. The issue affects specifically the AMF component and its interaction with the NRF (Network Repository Function) via the NF Discovery service. Any deployment using Open5GS for 5G core functions, including public/private operators, telecom vendors integrating Open5GS, and test/lab environments, is in scope. Non-AMF components (UPF, SMF, etc.) are not directly impacted by this flaw.

Exploitability

The vulnerability has a low attack complexity and requires only valid authentication credentials to trigger. In 5G networks, service-to-service communication often relies on mutual TLS or similar mechanisms; an attacker with compromised service credentials, insider access, or ability to pivot from another breached component can exploit this remotely without user interaction. Public exploit code is available, reducing the technical barrier to weaponization. However, the requirement for authenticated access prevents unauthenticated external exploitation.

Remediation

Upgrade Open5GS to a version containing commit fb5f67703de0213fb9c6e6ef3b48b6c1707e9503 or later. Verify the patch availability in the official Open5GS repository and release notes. In the interim, network segmentation to restrict service-to-service communication to trusted endpoints and credential rotation for service accounts can reduce exposure. Monitor for unexpected AMF restarts or service disruptions that may indicate exploitation attempts.

Patch guidance

The upstream patch is identified by commit hash fb5f67703de0213fb9c6e6ef3b48b6c1707e9503. Check the Open5GS GitHub repository and official release notes to confirm which version(s) incorporate this fix. Apply patches first in non-production environments to verify compatibility and functionality. Given the authenticated nature of the attack, prioritize patching systems accessible from untrusted network segments or those running with overly permissive service credentials. Coordinate patching with your 5G network maintenance windows to minimize service disruption.

Detection guidance

Monitor AMF logs for unhandled exceptions or crashes triggered by NF Discovery requests, particularly from unusual or unexpected network function sources. Implement alerting on unexpected AMF process restarts. Network-level detection should focus on anomalous NF Discovery (HTTPS requests to the NRF endpoint with unusual payloads) originating from authenticated service identities. Baseline normal discovery traffic patterns and alert on deviations. In SIEM platforms, correlate authentication logs with subsequent service disruptions to identify potential attack chains.

Why prioritize this

Although classified as MEDIUM severity, this vulnerability merits prompt attention because it affects a critical 5G core component, has public exploit code, and targets authenticated services that may be reachable from compromised internal systems. The combination of ease of exploitation (once authenticated) and the criticality of AMF functionality elevates practical risk beyond the numerical score. Organizations with public-facing or customer-connected 5G networks should prioritize this over other MEDIUM-severity issues affecting non-critical components.

Risk score, explained

The CVSS v3.1 score of 4.3 reflects the requirement for authenticated access and the absence of impact to confidentiality or integrity—only availability is degraded. However, this does not account for the widespread deployment of Open5GS, the public availability of exploit code, or the criticality of the AMF function in 5G operations. A breach of service-account credentials via another vulnerability or insider threat immediately raises practical risk. Organizations should apply a local risk multiplier based on their network architecture, credential hygiene, and the AMF's role in their operations.

Frequently asked questions