CVE-2026-2524: Open5GS MME mme_s11_handle_create_session_response denial of service

Published Feb 16, 2026

Updated

A flaw has been found in Open5GS 2.7.6. The impacted element is the function mmes11handlecreatesessionresponse of the component MME. This manipulation causes denial of service. The attack can be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Affected Software

2 affected components

open5gs open5gs

open5gs open5gs=2.7.6

Event History

Feb 16, 2026

CVE Published

via MITRE·12:32 AM

Data Sourced

via MITRE·12:32 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·01:15 AM

DescriptionSeverityWeaknessAffected Software

Feb 9, 58115

Event

via FIRST·08:48 PM

Frequently Asked Questions

What is the severity of CVE-2026-2524?

CVE-2026-2524 is classified as a high severity denial of service vulnerability affecting Open5GS.

How do I fix CVE-2026-2524?

To fix CVE-2026-2524, update Open5GS to the latest version that addresses this vulnerability.

Who is affected by CVE-2026-2524?

CVE-2026-2524 affects users of Open5GS version 2.7.6 and potentially other versions if not patched.

What kind of attack is associated with CVE-2026-2524?

CVE-2026-2524 is associated with a remote denial of service attack that disrupts the MME component.

What component of Open5GS is vulnerable in CVE-2026-2524?

The vulnerable component in CVE-2026-2524 is the MME function 'mme_s11_handle_create_session_response'.