CVE-2026-10156

MEDIUM

Open5GS nf-instances Endpoint nnrf-handler.c handle_amf_info resource consumption

Title source: cna
STIX 2.1

Description

A vulnerability was determined in Open5GS up to 2.7.7. This affects the function handle_amf_info in the library /lib/sbi/nnrf-handler.c of the component nf-instances Endpoint. Executing a manipulation of the argument nf_info_pool can lead to resource consumption. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. Applying a patch is advised to resolve this issue. The issue report is flagged as already-fixed.

References (5)

Core 5
Core References
Vdb Entry, Technical Description vdb-entry technical-description
VDB-367409 | Open5GS nf-instances Endpoint nnrf-handler.c handle_amf_info resource consumption
https://vuldb.com/vuln/367409
Signature, Permissions Required signature permissions-required
VDB-367409 | CTI Indicators (IOB, IOC, TTP, IOA)
https://vuldb.com/vuln/367409/cti
Third Party Advisory third-party-advisory
Submit #818598 | Open5GS NRF v2.7.7 Denial of Service
https://vuldb.com/submit/818598
Exploit exploit issue-tracking
https://github.com/open5gs/open5gs/issues/4480

Scores

CVSS v3 4.3
EPSS 0.0028
EPSS Percentile 19.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-400 CWE-404
Status published
Products (8)
None/Open5GS 2.7.0
None/Open5GS 2.7.1
None/Open5GS 2.7.2
None/Open5GS 2.7.3
None/Open5GS 2.7.4
None/Open5GS 2.7.5
None/Open5GS 2.7.6
None/Open5GS 2.7.7
Published May 31, 2026
Tracked Since May 31, 2026