CVE-2026-108103 Overview
CVE-2026-108103 is a heap out-of-bounds read vulnerability in Open5GS through version 2.8.0. The flaw resides in the ogs_pfcp_parse_dropped_dl_traffic_threshold() function within the Packet Forwarding Control Protocol (PFCP) parser. Remote unauthenticated attackers can read past Information Element (IE) buffers by sending malformed short IEs. The attack targets the User Plane Function (UPF) over UDP port 8805 using PFCP Session Establishment or Modification Requests with the DLPA and DLBY flags set. Successful exploitation can crash the UPF, disrupting 5G core network operations. The vulnerability is tracked under [CWE-125] Out-of-Bounds Read.
Critical Impact
Unauthenticated remote attackers can crash the Open5GS UPF service by sending crafted PFCP packets, causing availability loss across dependent 5G core functions.
Affected Products
- Open5GS versions through 2.8.0
- Open5GS User Plane Function (UPF) component
- Open5GS PFCP library (lib/pfcp/types.c)
Discovery Timeline
- 2026-10-09 - CVE-2026-108103 published to NVD
- 2026-10-14 - Last updated in NVD database
Technical Details for CVE-2026-108103
Vulnerability Analysis
The vulnerability affects Open5GS, an open-source implementation of 5G Core and EPC. The defective code lives in ogs_pfcp_parse_dropped_dl_traffic_threshold() within lib/pfcp/types.c. The parser handles the Dropped DL Traffic Threshold Information Element used in PFCP messages exchanged between the Session Management Function (SMF) and the UPF. When the parser processes an IE shorter than expected, it reads bytes beyond the allocated buffer boundary. The read occurs on heap memory, enabling attackers to force the UPF process to access unmapped or adjacent memory regions. This triggers a crash and denial-of-service condition on the 5G user plane.
Root Cause
The root cause is missing length validation on incoming IEs before parsing. The function assumes a minimum IE size when the DLPA (Downlink Packets) and DLBY (Downlink Bytes) flags are set. Attackers supplying truncated IEs cause the function to dereference offsets past the buffer end. The upstream fix is tracked in Open5GS commit 88e64fc, which adds bounds checks before accessing IE data.
Attack Vector
An attacker reaches the vulnerable code path by sending PFCP Session Establishment Request or PFCP Session Modification Request messages to the UPF on UDP port 8805. The messages must include a Dropped DL Traffic Threshold IE with the DLPA and DLBY flags set and insufficient payload bytes. PFCP does not require authentication at the protocol layer, so any attacker with network reachability to the UPF signaling interface can trigger the condition. Operators that expose PFCP endpoints to untrusted networks face immediate risk.
No verified public exploit code is available. See the VulnCheck Open5GS Advisory for additional technical analysis.
Detection Methods for CVE-2026-108103
Indicators of Compromise
- Unexpected restarts or crashes of the open5gs-upfd process on UPF hosts.
- PFCP Session Establishment or Modification Requests originating from unexpected source IP addresses on UDP port 8805.
- Malformed PFCP messages carrying Dropped DL Traffic Threshold IEs with truncated length fields.
Detection Strategies
- Deploy network monitoring on the Sxa/Sxb/N4 interfaces to parse PFCP messages and flag IEs with lengths inconsistent with the DLPA and DLBY flag combinations.
- Enable core dump collection on UPF hosts and alert on repeated segmentation faults in ogs_pfcp_parse_dropped_dl_traffic_threshold.
- Correlate UPF restart events with inbound PFCP traffic volume to identify crash-trigger attempts.
Monitoring Recommendations
- Collect UPF service telemetry (process uptime, restart counts, syslog entries) into a central security data store for correlation.
- Monitor UDP port 8805 traffic patterns and alert on connections from non-SMF source addresses.
- Review PFCP message rates for anomalous spikes indicative of fuzzing or targeted DoS attempts.
How to Mitigate CVE-2026-108103
Immediate Actions Required
- Upgrade Open5GS to a version containing the fix from commit 88e64fc.
- Restrict UDP port 8805 exposure to trusted SMF peers only, using host firewalls or network ACLs.
- Audit PFCP-facing interfaces to confirm they are not reachable from the internet or untrusted administrative networks.
Patch Information
The maintainers addressed the issue in the Open5GS GitHub repository via commit 88e64fc1f87e0d321364b3bb710ef6a8f274e568. The patch adds proper boundary validation before accessing IE buffer contents in ogs_pfcp_parse_dropped_dl_traffic_threshold(). Operators running Open5GS 2.8.0 or earlier should rebuild from a patched source tree or upgrade to the next tagged release that includes the commit.
Workarounds
- Apply strict source-IP allowlisting on UDP port 8805 so only known SMF nodes can reach the UPF.
- Deploy a PFCP-aware proxy or inspection appliance that validates IE lengths before forwarding traffic.
- Isolate the N4 interface onto a dedicated management VLAN segregated from subscriber and external traffic.
# Example iptables rule restricting PFCP (UDP 8805) to a known SMF peer
iptables -A INPUT -p udp --dport 8805 -s <SMF_IP> -j ACCEPT
iptables -A INPUT -p udp --dport 8805 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
