CVE-2026-78186: Open5GS HSS hss-cx-path.c assertion
A flaw has been found in Open5GS up to 2.8.0. This affects an unknown function of the file src/hss/hss-cx-path.c of the component HSS. This manipulation of the argument User-Name causes reachable assertion. The attack is possible to be carried out remotely. The exploit has been published and may be used. Patch name: c9abe09421eb99bbf1cd7862a3d375e58a4eb9e4. It is recommended to apply a patch to fix this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Open5GS HSSto a version that resolves this vulnerability.Patch c9abe09421eb99bbf1cd7862a3d375e58a4eb9e4
Event History
Frequently Asked Questions
Which Open5GS deployments are affected?
Open5GS versions up to and including 2.8.0 are affected when the HSS component is in use. The vulnerable code is in src/hss/hss-cx-path.c.
What does an attacker need to exploit this issue?
An attacker needs network reachability to the affected HSS functionality and the ability to manipulate the User-Name argument. The issue can be exploited remotely and requires low privileges; no user interaction is required.
What is the likely impact of successful exploitation?
Successful exploitation can trigger a reachable assertion, resulting in an availability impact. The supplied severity vector indicates no confidentiality or integrity impact.
How should this be remediated?
Apply the patch identified as c9abe09421eb99bbf1cd7862a3d375e58a4eb9e4. This is particularly important because a public exploit has been published.