CVE-2026-116543: Open5GS 1.3.0 through 2.8.0 Heap Out-of-Bounds Write via SBI Multipart Parser
Open5GS 1.3.0 through 2.8.0 contains a heap out-of-bounds write vulnerability in parsemultipart() that allows unauthenticated attackers to corrupt memory by supplying an empty multipart boundary. Attackers can send a single crafted multipart/related request to the SBI interface of any network function, overflowing the lookbehind buffer and crashing it.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Open5GS versions 1.3.0 through 2.8.0 are affected when an attacker can reach the SBI interface of a network function. The attack is network-based and does not require authentication or user interaction.
What does an attacker need to send to trigger the flaw?
An attacker needs to send a single crafted multipart/related request with an empty multipart boundary to the SBI interface. The malformed boundary causes an out-of-bounds write in parse_multipart().
What is the expected impact of exploitation?
The supplied data indicates that the overflow corrupts heap memory and can crash the targeted network function. The listed impact is availability only; no confidentiality or integrity impact is specified.