CVE-2025-15419: Open5GS GTPv2-C Handler DoS Vulnerability

CVE-2025-15419 Overview

A denial of service vulnerability has been identified in Open5GS versions up to 2.7.6. This weakness affects the function sgwc_s5c_handle_create_session_response within the file src/sgwc/s5c-handler.c of the GTPv2-C Flow Handler component. The vulnerability stems from improper resource shutdown or release (CWE-404), which can be exploited by a local attacker to cause service disruption.

Critical Impact

Local attackers with low privileges can exploit this vulnerability to cause denial of service conditions in Open5GS 5G/LTE core network deployments, potentially disrupting mobile network services.

Affected Products

• Open5GS versions up to and including 2.7.6
• SGW-C (Serving Gateway Control Plane) component
• Systems utilizing the GTPv2-C protocol handler

Discovery Timeline

• 2026-01-02 - CVE-2025-15419 published to NVD
• 2026-01-06 - Last updated in NVD database

Technical Details for CVE-2025-15419

Vulnerability Analysis

This vulnerability resides in the SGW-C (Serving Gateway Control Plane) component of Open5GS, specifically within the GTPv2-C protocol handler. The affected function sgwc_s5c_handle_create_session_response fails to properly validate mandatory Information Elements (IEs) in GTPv2-C messages and does not safely handle missing bearer context scenarios.

When processing Create Session Response messages, the original implementation would encounter errors with missing EPS Bearer ID or GTP TEID fields but would only log the error and break out of the processing loop rather than properly terminating the session and sending appropriate error responses. This improper resource management can lead to inconsistent state and service disruption.

Root Cause

The root cause is classified under CWE-404 (Improper Resource Shutdown or Release). The vulnerable code path fails to properly release resources and send appropriate GTPv2-C error responses when mandatory Information Elements are missing from bearer contexts. Instead of gracefully handling these error conditions with proper protocol-level error messages, the code simply breaks out of the processing loop, leaving the system in a potentially inconsistent state.

Attack Vector

This vulnerability requires local access to exploit. An attacker with low-level privileges on the affected system can manipulate GTPv2-C protocol messages to trigger the vulnerable code path. By sending malformed Create Session Response messages with missing mandatory fields such as EPS Bearer ID or S5/S8 U-SGW F-TEID, an attacker can cause the SGW-C component to enter an error state, resulting in denial of service.

The patch addresses this by implementing proper error handling that sends OGS_GTP2_CAUSE_MANDATORY_IE_MISSING error responses and returns immediately when mandatory IEs are absent:

         }
         if (rsp->bearer_contexts_created[i].eps_bearer_id.presence == 0) {
             ogs_error("No EPS Bearer ID");
-            break;
+            ogs_gtp_send_error_message(
+                    s11_xact, sgwc_ue ? sgwc_ue->mme_s11_teid : 0,
+                    OGS_GTP2_CREATE_SESSION_RESPONSE_TYPE,
+                    OGS_GTP2_CAUSE_MANDATORY_IE_MISSING);
+            return;
         }
         if (rsp->bearer_contexts_created[i].s5_s8_u_sgw_f_teid.presence == 0) {
             ogs_error("No GTP TEID");
-            break;
+            ogs_gtp_send_error_message(
+                    s11_xact, sgwc_ue ? sgwc_ue->mme_s11_teid : 0,
+                    OGS_GTP2_CREATE_SESSION_RESPONSE_TYPE,
+                    OGS_GTP2_CAUSE_MANDATORY_IE_MISSING);
+            return;
         }

         /* EPS Bearer ID */
         bearer = sgwc_bearer_find_by_sess_ebi(sess,
                     rsp->bearer_contexts_created[i].eps_bearer_id.u8);
         if (!bearer) {
+            ogs_error("No Bearer [%d]",
+                    rsp->bearer_contexts_created[i].eps_bearer_id.u8);
             ogs_gtp_send_error_message(
                     s11_xact, sgwc_ue ? sgwc_ue->mme_s11_teid : 0,
                     OGS_GTP2_CREATE_SESSION_RESPONSE_TYPE,
-                    OGS_GTP2_CAUSE_MANDATORY_IE_MISSING);

Source: GitHub Commit Update

Detection Methods for CVE-2025-15419

Indicators of Compromise

• Unexpected crashes or restarts of the open5gs-sgwcd service
• GTPv2-C error messages in logs indicating "No EPS Bearer ID" or "No GTP TEID" without corresponding error responses
• Abnormal patterns in GTPv2-C Create Session Response message handling
• Service degradation in mobile network connectivity through the SGW-C component

Detection Strategies

• Monitor Open5GS SGW-C logs for repeated error messages related to missing mandatory IEs in bearer contexts
• Implement GTPv2-C protocol inspection to detect malformed Create Session Response messages
• Set up service health checks for the SGW-C component to detect unexpected service interruptions
• Deploy SentinelOne agents to monitor process behavior and detect anomalous crashes or resource exhaustion patterns

Monitoring Recommendations

• Configure alerting for SGW-C service availability and restart events
• Implement GTPv2-C traffic analysis to baseline normal message patterns and detect anomalies
• Monitor system resources (memory, CPU) for the Open5GS processes to detect resource exhaustion conditions
• Enable detailed logging for the src/sgwc/s5c-handler.c component to capture error conditions

How to Mitigate CVE-2025-15419

Immediate Actions Required

• Upgrade Open5GS to a version containing the security patch (commit 5aaa09907e7b9e0a326265a5f08d56f54280b5f2)
• Review and apply network segmentation to limit local access to Open5GS infrastructure
• Implement access controls to restrict which users and processes can interact with the SGW-C component
• Enable enhanced monitoring and logging for the affected GTPv2-C handler

Patch Information

The vulnerability has been addressed in the Open5GS repository. The security patch is identified by commit hash 5aaa09907e7b9e0a326265a5f08d56f54280b5f2. This patch modifies the sgwc_s5c_handle_create_session_response function to properly validate mandatory Information Elements and send appropriate GTPv2-C error responses when validation fails, rather than simply breaking out of the processing loop.

For detailed patch information, refer to:

• GitHub Commit Update
• GitHub Issue Report

Workarounds

• Restrict local access to the Open5GS deployment environment to trusted users only
• Implement network-level filtering to validate GTPv2-C message integrity before reaching the SGW-C
• Deploy the SGW-C component in an isolated environment with strict access controls
• Consider implementing rate limiting on GTPv2-C interfaces to mitigate potential DoS attempts

# Example: Restrict access to Open5GS configuration and binaries
chmod 750 /etc/open5gs
chown -R root:open5gs /etc/open5gs
chmod 750 /usr/bin/open5gs-sgwcd

# Ensure only authorized users can interact with Open5GS services
usermod -aG open5gs trusted_admin