CVE-2026-2517

MEDIUM

Open5GS < 2.7.6 - Denial of Service via TFT Length Manipulation in SMF

Title source: llm
STIX 2.1

Description

A security flaw has been discovered in Open5GS up to 2.7.6. This vulnerability affects the function ogs_gtp2_parse_tft in the library lib/gtp/v2/types.c of the component SMF. Performing a manipulation of the argument pf[0].content.length results in denial of service. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

References (6)

Core 6
Core References
Permissions Required, VDB Entry vdb-entry technical-description
https://vuldb.com/?id.346108
Permissions Required, VDB Entry signature permissions-required
https://vuldb.com/?ctiid.346108
Permissions Required, VDB Entry third-party-advisory
https://vuldb.com/?submit.738332
Issue Tracking issue-tracking
https://github.com/open5gs/open5gs/issues/4281
Various Sources product
https://github.com/open5gs/open5gs/

Scores

CVSS v3 5.3
EPSS 0.0050
EPSS Percentile 38.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact partial

Details

CWE
CWE-404
Status published
Products (1)
open5gs/open5gs < 2.7.6
Published Feb 15, 2026
Tracked Since Feb 18, 2026