CVE-2026-92417: Open5GS PFCP types.c ogs_pfcp_parse_volume_measurement null pointer dereference
A vulnerability was found in Open5GS up to 2.8.0. This affects the function ogspfcpparsevolumemeasurement in the library lib/pfcp/types.c of the component PFCP Handler. The manipulation results in null pointer dereference. The attack may be launched remotely. The patch is identified as 8f07b507b78ff94776f2cd49276eb116ed93d7f2. A patch should be applied to remediate this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Open5GSto a version that resolves this vulnerability.Patch 8f07b507b78ff94776f2cd49276eb116ed93d7f2
Event History
Frequently Asked Questions
Which deployments are affected?
Open5GS versions up to and including 2.8.0 are affected, specifically the PFCP Handler component in lib/pfcp/types.c.
What level of access does an attacker need?
The issue can be triggered remotely and requires low privileges. No user interaction is required.
What is the likely impact of successful exploitation?
Successful exploitation can cause a null pointer dereference, resulting in a high availability impact.
What should be done to remediate the issue?
Apply the patch identified as 8f07b507b78ff94776f2cd49276eb116ed93d7f2.