CVE-2025-15539: Open5GS DoS Vulnerability in sgwc

CVE-2025-15539 Overview

A denial of service vulnerability has been identified in Open5GS up to version 2.7.6. The vulnerability affects the sgwc_s11_handle_downlink_data_notification_ack function within the src/sgwc/s11-handler.c file of the SGWC (Serving Gateway Control) component. This flaw allows remote attackers to trigger a denial of service condition by exploiting improper resource handling. The exploit has been publicly disclosed and a patch is available.

Critical Impact

Remote attackers can cause denial of service in Open5GS 5G core network infrastructure by triggering fatal assertions in the SGWC component, potentially disrupting mobile network services.

Affected Products

• Open5GS versions up to 2.7.6
• SGWC (Serving Gateway Control) component
• Systems running vulnerable src/sgwc/s11-handler.c implementations

Discovery Timeline

• 2026-01-19 - CVE CVE-2025-15539 published to NVD
• 2026-01-19 - Last updated in NVD database

Technical Details for CVE-2025-15539

Vulnerability Analysis

This vulnerability is classified under CWE-404 (Improper Resource Shutdown or Release). The core issue lies in the sgwc_s11_handle_downlink_data_notification_ack function where fatal assertions (ogs_assert) are used without proper null checks or validation. When processing Downlink Data Notification Acknowledgment messages, the function assumes certain data structures are always present and valid. An attacker can craft malicious network packets that cause these assertions to fail, resulting in immediate process termination and service disruption.

The vulnerability is exploitable remotely over the network without requiring authentication or user interaction. This makes it particularly concerning for production 5G core deployments where service availability is critical.

Root Cause

The root cause is the improper use of fatal assertions (ogs_assert) for handling conditions that could legitimately occur during normal operation or through malicious input. Specifically, the vulnerable code assumed:

1. Transaction data (s11_xact->data) would always be present
2. Bearer IDs would always be within valid pool bounds
3. Bearer and session objects would always be found when referenced

These assumptions lead to fatal program termination when violated, rather than graceful error handling.

Attack Vector

An attacker with network access to the SGWC interface can send specially crafted Downlink Data Notification Acknowledgment messages that:

1. Contain missing transaction data
2. Reference invalid or out-of-bounds bearer IDs
3. Reference non-existent bearer or session objects

The attack requires no authentication and can be executed remotely, making it accessible to any attacker with network visibility to the vulnerable component.

      * Check Transaction
      ********************/
     ogs_assert(s11_xact);
-    ogs_assert(s11_xact->data);
+
+    if (!s11_xact->data) {
+        ogs_error("No Transaction Data in Downlink Data Notification Ack");
+        goto out;
+    }
+
     bearer_id = OGS_POINTER_TO_UINT(s11_xact->data);
-    ogs_assert(bearer_id >= OGS_MIN_POOL_ID &&
-            bearer_id <= OGS_MAX_POOL_ID);
+    if (bearer_id < OGS_MIN_POOL_ID || bearer_id > OGS_MAX_POOL_ID) {
+        ogs_error("Invalid Bearer ID [%d] in Downlink Data Notification Ack",
+                bearer_id);
+        goto out;
+    }
 
     bearer = sgwc_bearer_find_by_id(bearer_id);
-    ogs_assert(bearer);
+    if (!bearer) {
+        ogs_warn("Bearer Not Found [id:%d] in Downlink Data Notification Ack",
+                bearer_id);
+        goto out;
+    }
+
     sess = sgwc_sess_find_by_id(bearer->sess_id);
-    ogs_assert(sess);
+    if (!sess) {

Source: GitHub Commit Update

Detection Methods for CVE-2025-15539

Indicators of Compromise

• Unexpected SGWC process crashes or restarts
• Core dumps containing assertion failures in sgwc_s11_handle_downlink_data_notification_ack
• Log entries showing abnormal Downlink Data Notification Ack processing
• Elevated rate of GTP-C protocol errors on the S11 interface

Detection Strategies

• Monitor SGWC process stability and implement alerting on unexpected terminations
• Analyze GTP-C traffic patterns for malformed Downlink Data Notification Acknowledgment messages
• Review system logs for ogs_assert failure messages in the SGWC component
• Implement network traffic analysis for anomalous S11 interface activity

Monitoring Recommendations

• Configure process monitoring with automatic restart capabilities for the SGWC service
• Enable detailed logging for the S11 handler functions to capture potential attack attempts
• Set up alerts for bearer ID validation failures and missing transaction data errors
• Monitor network traffic on GTP-C interfaces for unusual packet patterns

How to Mitigate CVE-2025-15539

Immediate Actions Required

• Upgrade Open5GS to a version containing patch b4707272c1caf6a7d4dca905694ea55557a0545f
• Implement network segmentation to limit access to SGWC interfaces
• Enable process monitoring and automatic restart for critical 5G core components
• Review firewall rules to restrict S11 interface access to trusted network elements

Patch Information

The vulnerability has been addressed in the Open5GS repository. The fix replaces fatal assertions with proper error handling, allowing the function to gracefully handle edge cases without terminating the process. The patch (commit b4707272c1caf6a7d4dca905694ea55557a0545f) adds null checks for transaction data, validates bearer ID bounds, and verifies bearer and session object existence before use. For technical details, see the GitHub Commit Update and GitHub Issue Discussion.

Workarounds

• Restrict network access to SGWC S11 interfaces using firewall rules
• Implement process supervisors to automatically restart the SGWC service upon crashes
• Deploy network intrusion detection systems to identify malicious GTP-C traffic
• Consider running SGWC in a containerized environment with automatic restart policies

# Configuration example
# Restrict S11 interface access via iptables
iptables -A INPUT -p udp --dport 2123 -s trusted_mme_ip -j ACCEPT
iptables -A INPUT -p udp --dport 2123 -j DROP

# Enable process monitoring with systemd restart policy
# Add to /etc/systemd/system/open5gs-sgwcd.service
# [Service]
# Restart=always
# RestartSec=5