CVE-2026-1521: Open5GS SGWC DoS Vulnerability

CVE-2026-1521 Overview

A denial of service vulnerability has been discovered in Open5GS up to version 2.7.6. This security flaw affects the function sgwc_s5c_handle_bearer_resource_failure_indication within the file src/sgwc/s5c-handler.c of the SGWC (Serving Gateway Control Plane) component. By sending specially crafted network requests, an attacker can cause the service to crash, resulting in denial of service conditions for mobile network infrastructure.

Critical Impact

Remote attackers can disrupt 5G/LTE core network operations by crashing the SGWC component, potentially affecting mobile connectivity for users relying on the affected Open5GS deployment.

Affected Products

• Open5GS versions up to and including 2.7.6
• SGWC (Serving Gateway Control Plane) component
• Deployments utilizing the S5-C interface for bearer resource management

Discovery Timeline

• 2026-01-28 - CVE CVE-2026-1521 published to NVD
• 2026-01-29 - Last updated in NVD database

Technical Details for CVE-2026-1521

Vulnerability Analysis

This vulnerability is classified as CWE-404 (Improper Resource Shutdown or Release), manifesting as an improper handling scenario within the SGWC component of Open5GS. The flaw occurs when processing late BearerResourceFailureIndication messages where the associated S11 transaction has already been released or is unavailable.

When a BearerResourceFailureIndication arrives after its corresponding S11 transaction has timed out or been otherwise terminated, the handler function fails to properly validate the transaction state before proceeding. This results in the application attempting to access a null or invalid transaction object, leading to a crash condition.

The vulnerability is remotely exploitable over the network without requiring authentication, making it particularly concerning for publicly accessible or poorly segmented Open5GS deployments.

Root Cause

The root cause lies in insufficient validation of the S11 transaction state within the sgwc_s5c_handle_bearer_resource_failure_indication function. When receiving a BearerResourceFailureIndication message on the S5-C interface, the code retrieves the associated S11 transaction using assoc_xact_id. However, if this transaction has already been released due to timeout or completion, the subsequent operations on the null transaction pointer cause the service to crash.

The fix improves error handling by adding the assoc_xact_id to the error message for debugging purposes while ensuring the function returns gracefully when no S11 transaction exists.

Attack Vector

An attacker can exploit this vulnerability by manipulating the timing of GTP-C (GPRS Tunneling Protocol Control) messages on the S5-C interface. By sending a BearerResourceFailureIndication message with a transaction ID that references an already-completed or timed-out S11 session, the attacker triggers the crash condition. This attack can be performed remotely over the network and does not require prior authentication to the Open5GS system.

     ogs_expect(rv == OGS_OK);
 
     if (!s11_xact) {
-        ogs_error("No S11 Transaction");
+        ogs_error("No S11 Transaction (assoc_xact_id=%u)",
+                s5c_xact->assoc_xact_id);
         return;
     }
 

Source: GitHub Commit Changes

Detection Methods for CVE-2026-1521

Indicators of Compromise

• Unexpected crashes or restarts of the SGWC process in Open5GS deployments
• Log entries containing "No S11 Transaction" errors followed by service termination
• Unusual patterns of GTP-C BearerResourceFailureIndication messages on the S5-C interface
• Increased volume of malformed or out-of-sequence bearer resource failure messages

Detection Strategies

• Monitor SGWC process stability and implement alerting for unexpected service restarts
• Analyze GTP-C traffic on the S5-C interface for anomalous BearerResourceFailureIndication message patterns
• Implement network intrusion detection rules to identify suspicious timing patterns in bearer resource messages
• Review Open5GS logs for repeated "No S11 Transaction" error messages indicating potential exploitation attempts

Monitoring Recommendations

• Deploy continuous monitoring for SGWC service availability and automatic restart events
• Implement rate limiting on the S5-C interface to mitigate flood-based denial of service attempts
• Configure logging verbosity to capture transaction ID mismatches for forensic analysis
• Establish baseline metrics for normal bearer resource failure indication rates to detect anomalies

How to Mitigate CVE-2026-1521

Immediate Actions Required

• Apply the security patch identified by commit 69b53add90a9479d7960b822fc60601d659c328b immediately
• Restrict network access to the S5-C interface to trusted network segments only
• Implement process monitoring to automatically restart SGWC in case of unexpected termination
• Review and harden firewall rules controlling access to Open5GS core network components

Patch Information

The vulnerability has been addressed in the Open5GS repository through commit 69b53add90a9479d7960b822fc60601d659c328b. This patch improves the error handling in the sgwc_s5c_handle_bearer_resource_failure_indication function by ensuring graceful handling when the S11 transaction is unavailable, and adds improved logging for debugging purposes.

Organizations running Open5GS version 2.7.6 or earlier should apply this patch or upgrade to a version containing the fix. The patch is available via the GitHub Commit Changes. Additional technical discussion can be found in the GitHub Issue Discussion.

Workarounds

• Implement network segmentation to restrict access to the SGWC S5-C interface from untrusted networks
• Deploy a reverse proxy or firewall with GTP-C protocol awareness to filter malformed messages
• Configure process supervision (e.g., systemd, supervisord) to automatically restart SGWC upon crash
• Enable enhanced logging to detect and respond to exploitation attempts before widespread impact

# Configuration example
# Restrict S5-C interface access using iptables
# Replace <trusted_network> with your actual PGW/SMF network range
iptables -A INPUT -p udp --dport 2123 -s <trusted_network> -j ACCEPT
iptables -A INPUT -p udp --dport 2123 -j DROP

# Enable automatic restart in systemd service file
# Add to [Service] section of open5gs-sgwcd.service
Restart=always
RestartSec=5