CVE-2025-15528

MEDIUM

Open5GS < 2.7.6 - Denial of Service in GTPv2 Bearer Response Handler

Title source: llm
STIX 2.1

Description

A vulnerability has been found in Open5GS up to 2.7.6. Affected by this vulnerability is an unknown functionality of the component GTPv2 Bearer Response Handler. Such manipulation leads to denial of service. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 98f76e98df35cd6a35e868aa62715db7f8141ac1. A patch should be applied to remediate this issue.

References (10)

Core 10
Core References
Third Party Advisory, VDB Entry vdb-entry technical-description
https://vuldb.com/?id.341595
Permissions Required, VDB Entry signature permissions-required
https://vuldb.com/?ctiid.341595
Third Party Advisory, VDB Entry third-party-advisory
https://vuldb.com/?submit.728128
Permissions Required, VDB Entry third-party-advisory
https://vuldb.com/?submit.729359
Permissions Required, VDB Entry third-party-advisory
https://vuldb.com/?submit.729360
Permissions Required, VDB Entry third-party-advisory
https://vuldb.com/?submit.738373
Exploit, Issue Tracking, Vendor Advisory issue-tracking
https://github.com/open5gs/open5gs/issues/4225
Exploit, Issue Tracking, Vendor Advisory exploit issue-tracking
https://github.com/open5gs/open5gs/issues/4225#issue-3769531006
Various Sources product
https://github.com/open5gs/open5gs/

Scores

CVSS v3 5.3
EPSS 0.0083
EPSS Percentile 52.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact partial

Details

CWE
CWE-404
Status published
Products (1)
open5gs/open5gs < 2.7.6
Published Jan 16, 2026
Tracked Since Feb 18, 2026