CVE-2026-78156: Open5GS S6a Authentication-Information-Request hss-s6a-path.c hss_ogs_diam_s6a_air_cb heap-based overflow
A security vulnerability has been detected in Open5GS 2.8.0. Affected by this issue is the function hssogsdiams6aaircb of the file src/hss/hss-s6a-path.c of the component S6a Authentication-Information-Request Handler. Such manipulation of the argument Visited-PLMN-Id leads to heap-based buffer overflow. The attack may be performed from remote. The name of the patch is a9c82ee0b590d76a581b0580cb46b598984e2392. A patch should be applied to remediate this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Open5GSto a version that resolves this vulnerability.Patch a9c82ee0b590d76a581b0580cb46b598984e2392
Event History
Frequently Asked Questions
Which deployments are known to be affected?
The issue is reported in Open5GS version 2.8.0, specifically in the HSS S6a Authentication-Information-Request handling path.
What access does an attacker need to exploit this issue?
The attack can be performed remotely and requires low privileges. Exploitation involves manipulating the Visited-PLMN-Id argument processed by the S6a handler.
What should be done to remediate the vulnerability?
Apply the patch identified as a9c82ee0b590d76a581b0580cb46b598984e2392. The provided information does not specify an alternative mitigation for environments that cannot patch immediately.