CVE-2025-55904: Open5GS NULL Pointer DoS Vulnerability

CVE-2025-55904 Overview

CVE-2025-55904 is a NULL pointer dereference vulnerability in Open5GS, an open-source 5G Core and EPC implementation. Versions up to and including v2.7.5 are affected, prior to commit 67ba7f92bbd7a378954895d96d9d7b05d5b64615. The flaw resides in the parse_multipart function in lib/sbi/message.c. An attacker who can reach the Service Based Interface (SBI) of any AMF, AUSF, BSF, NRF, NSSF, PCF, SMF, UDM, or UDR network function can send a multipart/related HTTP POST request with an empty body to trigger the crash, causing a denial of service on the targeted 5G core function.

Critical Impact
A single malformed HTTP request crashes any Open5GS Service Based Interface network function, disrupting 5G core control-plane availability [CWE-476].

Affected Products

Open5GS v2.7.5 and earlier
Open5GS builds prior to commit 67ba7f92bbd7a378954895d96d9d7b05d5b64615
Deployments exposing SBI endpoints for AMF, AUSF, BSF, NRF, NSSF, PCF, SMF, UDM, or UDR

Discovery Timeline

2025-09-17 - CVE-2025-55904 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-55904

Vulnerability Analysis

Open5GS network functions communicate over the 3GPP-defined Service Based Interface (SBI) using HTTP/2. The SBI message parser accepts multipart/related content, which 5G control-plane procedures use to carry JSON metadata alongside binary payloads such as N1/N2 signaling. The parse_multipart function in lib/sbi/message.c assumed the parsed HTTP request always carried a non-NULL content buffer. When an attacker submits a POST request declaring Content-Type: multipart/related but supplying an empty body, http->content remains NULL. The parser then dereferences this NULL pointer, crashing the network function process.

Any of the affected network functions (AMF, AUSF, BSF, NRF, NSSF, PCF, SMF, UDM, UDR) exposes the same vulnerable parser through its SBI. Loss of the NRF or AMF specifically disrupts registration, discovery, and session establishment for connected subscribers.

Root Cause

The root cause is missing input validation of the HTTP message body prior to processing. parse_multipart invoked the multipart parser state machine on http->content without first verifying the pointer was non-NULL and the content length was positive. This is a classic NULL pointer dereference [CWE-476].

Attack Vector

The attack requires network reachability to an Open5GS SBI listener. According to the CVSS metrics, the attack vector is scored as local access with low complexity and no authentication required. Exploitation consists of a single crafted HTTP POST to any SBI endpoint that dispatches through parse_multipart.

     ogs_assert(message);
     ogs_assert(http);
 
+    if (!http->content) {
+        ogs_error("HTTP content NULL [%d]", (int)http->content_length);
+        return OGS_ERROR;
+    }
+
     memset(&settings, 0, sizeof(settings));
     settings.on_header_field = &on_header_field;
     settings.on_header_value = &on_header_value;

Source: Open5GS commit 67ba7f9. The patch adds an explicit NULL check on http->content and returns OGS_ERROR before the parser is initialized.

Detection Methods for CVE-2025-55904

Indicators of Compromise

Unexpected termination or segmentation fault of open5gs-amfd, open5gs-nrfd, open5gs-smfd, open5gs-ausfd, open5gs-udmd, open5gs-udrd, open5gs-pcfd, open5gs-bsfd, or open5gs-nssfd processes
HTTP/2 POST requests to SBI listeners with Content-Type: multipart/related and a Content-Length of 0
Repeated restarts of Open5GS network function containers or systemd units in short intervals

Detection Strategies

Inspect SBI HTTP/2 traffic for multipart/related requests carrying empty bodies and alert on such patterns.
Correlate network-function crash events with inbound HTTP requests logged by the SBI to identify the triggering source.
Monitor process exit codes and core dump generation for Open5GS binaries and forward events to a central log store for hunting.

Monitoring Recommendations

Ingest Open5GS logs and systemd/journald service state changes into your SIEM or data lake for behavioral analysis.
Track availability metrics per network function (NRF discovery success, AMF registration completion) to detect DoS impact quickly.
Alert on repeated ogs_error("HTTP content NULL ...") entries after patching, which indicate ongoing exploitation attempts.

How to Mitigate CVE-2025-55904

Immediate Actions Required

Upgrade Open5GS to a build that includes commit 67ba7f92bbd7a378954895d96d9d7b05d5b64615 or later.
Restrict SBI listener exposure so only trusted 5G network functions can reach the HTTP/2 interfaces.
Enable service supervision (systemd Restart=on-failure, Kubernetes liveness probes) to reduce outage duration until patching is complete.

Patch Information

The fix is available in the upstream Open5GS repository via commit 67ba7f9 - [SBI] guard against NULL http->content in parse_multipart (#3942). Additional context is provided in Open5GS Issue #3942 and the CVE-2025-55904 research repository.

Workarounds

Place a reverse proxy or service mesh in front of SBI endpoints and drop multipart/related requests whose Content-Length is 0.
Enforce mutual TLS and network policy on the SBI so only authorized 5G network functions can send HTTP traffic to Open5GS.
Segment the 5G core network from operations, management, and external networks to limit blast radius during exploitation attempts.

bash

# Example: drop empty multipart/related POSTs at an nginx SBI ingress
map $http_content_type $block_empty_multipart {
    default 0;
    "~*multipart/related" 1;
}

server {
    listen 7777 http2;

    location / {
        if ($block_empty_multipart = 1) {
            set $flag "${block_empty_multipart}${content_length}";
        }
        if ($flag = "10") { return 400; }
        grpc_pass grpc://open5gs_sbi_upstream;
    }
}