CVE-2026-108102: Open5GS Buffer Overflow Vulnerability

CVE-2026-108102 Overview

CVE-2026-108102 is a heap out-of-bounds read vulnerability in Open5GS through version 2.8.0. The flaw resides in the ogs_pfcp_parse_volume_measurement() function within lib/pfcp/types.c. Remote unauthenticated attackers can send a crafted Packet Forwarding Control Protocol (PFCP) Session Report Request to the Session Management Function (SMF) on UDP port 8805. A short, all-flags Volume Measurement Information Element (IE) causes the parser to read up to 48 bytes past the IE buffer. Successful exploitation can crash the SMF, disrupting 5G core signaling. The vulnerability is tracked as [CWE-125] Out-of-Bounds Read.

Critical Impact
Unauthenticated remote attackers can crash the Open5GS SMF process by sending a single malformed PFCP packet, disrupting 5G core network operations.

Affected Products

Open5GS versions up to and including 2.8.0
Session Management Function (SMF) component
PFCP protocol handler in lib/pfcp/types.c

Discovery Timeline

2026-10-09 - CVE-2026-108102 published to NVD
2026-10-09 - Last updated in NVD database

Technical Details for CVE-2026-108102

Vulnerability Analysis

The vulnerability affects Open5GS, an open-source implementation of 5G Core and EPC. The PFCP protocol operates between the Session Management Function (SMF) and the User Plane Function (UPF) on UDP port 8805. Within the SMF, the ogs_pfcp_parse_volume_measurement() function parses Volume Measurement IEs received in PFCP Session Report Requests.

The parser trusts the flag byte in the IE header without validating that the declared length matches the actual payload size. When all flags are set but the IE payload is truncated, the function iterates through the expected fields and reads memory beyond the buffer boundary. Each flag can trigger an additional 8-byte read, resulting in up to 48 bytes read past the allocated buffer.

The out-of-bounds read can disclose adjacent heap contents or trigger a segmentation fault when accessing unmapped pages. A crash in the SMF process interrupts PFCP sessions and prevents new subscriber session establishment.

Root Cause

The root cause is missing length validation in ogs_pfcp_parse_volume_measurement(). The function reads optional fields based on the flag bitmask without verifying that enough bytes remain in the IE buffer. See the vulnerable code in lib/pfcp/types.c for reference.

Attack Vector

An attacker needs network reachability to the SMF on UDP port 8805. No authentication is required because PFCP as deployed by Open5GS does not enforce peer authentication at the application layer. The attacker sends a PFCP Session Report Request containing a Volume Measurement IE with all flags set and a truncated payload. The malformed IE triggers the out-of-bounds read and can crash the SMF daemon.

Technical details are available in the GitHub Security Advisory GHSA-37c3-hv4f-688p and the VulnCheck advisory.

Detection Methods for CVE-2026-108102

Indicators of Compromise

Unexpected SMF process crashes or restarts in the Open5GS deployment logs
Inbound UDP traffic to port 8805 originating from untrusted or non-UPF source addresses
Malformed PFCP Session Report Request packets containing Volume Measurement IEs with inconsistent length and flag fields
Core dumps referencing ogs_pfcp_parse_volume_measurement in the stack trace

Detection Strategies

Deploy packet inspection on the N4 interface to flag PFCP messages where declared IE length is smaller than the field size implied by the flag bitmask
Enable verbose Open5GS logging and alert on parser errors referencing types.c or PFCP IE decoding failures
Correlate SMF service restarts with inbound PFCP traffic from unexpected peers using telemetry collected in your SIEM or data lake

Monitoring Recommendations

Monitor UDP port 8805 for traffic volume anomalies and unauthorized source addresses
Track SMF process uptime and alert on repeated unplanned restarts within short time windows
Capture full PFCP traffic on the N4 interface for forensic replay when crashes occur

How to Mitigate CVE-2026-108102

Immediate Actions Required

Restrict UDP port 8805 to known UPF peer addresses using host firewall rules or network ACLs
Isolate the N4 interface onto a dedicated management or signaling VLAN that is not reachable from external networks
Upgrade Open5GS to a build that includes the fix commit 88e64fc
Monitor SMF process health and configure automatic restart with alerting

Patch Information

The Open5GS project addressed the vulnerability in commit 88e64fc1f87e0d321364b3bb710ef6a8f274e568. The patch adds length validation to ogs_pfcp_parse_volume_measurement() so the parser stops reading when the remaining IE buffer is smaller than the field required by a given flag. Rebuild Open5GS from a revision that includes this commit, or apply the patch to the v2.8.0 tree and recompile.

Workarounds

Apply strict ingress filtering on UDP port 8805 to allow only trusted UPF source IPs
Deploy IPsec or a dedicated transport network between SMF and UPF to prevent unauthorized PFCP peers from reaching the SMF
Rate-limit PFCP Session Report Requests at the network edge to reduce the impact of repeated crash attempts

bash

# Example iptables rule limiting UDP 8805 to trusted UPF peers
iptables -A INPUT -p udp --dport 8805 -s <UPF_IP> -j ACCEPT
iptables -A INPUT -p udp --dport 8805 -j DROP