CVE-2026-1522: Open5GS SGWC Denial of Service Vulnerability

CVE-2026-1522 Overview

A denial of service vulnerability has been identified in Open5GS versions up to 2.7.6. This vulnerability affects the function sgwc_s5c_handle_modify_bearer_response within the file src/sgwc/s5c-handler.c of the SGWC (Serving Gateway Control Plane) component. The vulnerability allows remote attackers to cause a denial of service condition through improper resource shutdown or release, classified under CWE-404.

Critical Impact
Remote attackers can exploit this vulnerability to disrupt 5G core network services by causing denial of service conditions in the SGWC component, potentially affecting mobile network connectivity and service availability.

Affected Products

Open5GS versions up to and including 2.7.6
SGWC (Serving Gateway Control Plane) component
Systems running vulnerable s5c-handler.c implementations

Discovery Timeline

2026-01-28 - CVE-2026-1522 published to NVD
2026-01-29 - Last updated in NVD database

Technical Details for CVE-2026-1522

Vulnerability Analysis

This vulnerability resides in the Open5GS SGWC component, specifically within the sgwc_s5c_handle_modify_bearer_response function located in src/sgwc/s5c-handler.c. Open5GS is an open-source implementation of 5G Core and EPC (Evolved Packet Core) networks, making this vulnerability particularly significant for telecommunications infrastructure.

The flaw is categorized as CWE-404: Improper Resource Shutdown or Release. This class of vulnerability occurs when a system fails to properly release or shut down resources when they are no longer needed, which can lead to resource exhaustion and subsequent denial of service conditions.

The vulnerability can be exploited remotely over the network without requiring any authentication or user interaction. An exploit has been made publicly available, increasing the risk of active exploitation attempts against unpatched systems.

Root Cause

The root cause of this vulnerability is improper resource shutdown or release (CWE-404) within the sgwc_s5c_handle_modify_bearer_response function. When processing modify bearer response messages on the S5-C interface, the function fails to properly manage resources, allowing attackers to trigger conditions that exhaust system resources or cause the service to become unresponsive.

Attack Vector

The attack can be launched remotely over the network targeting the SGWC component's S5-C interface. The S5-C interface is the control plane interface between the Serving Gateway (SGW) and Packet Data Network Gateway (PGW) in 4G/5G networks. An attacker with network access to this interface can send specially crafted modify bearer response messages to trigger the vulnerability.

The vulnerability has been addressed in commit b19cf6a. Technical details regarding the specific exploitation mechanism can be found in the GitHub Issue Tracker Entry and the associated patch commit.

Detection Methods for CVE-2026-1522

Indicators of Compromise

Unexpected crashes or restarts of the SGWC service
Abnormal resource consumption (memory or CPU) by the Open5GS SGWC process
Unusual patterns of modify bearer response messages on the S5-C interface
Service unavailability affecting mobile network connectivity

Detection Strategies

Monitor SGWC service health and availability metrics for unexpected degradation
Implement network traffic analysis for anomalous S5-C interface communications
Deploy log monitoring for error patterns related to sgwc_s5c_handle_modify_bearer_response function
Configure alerting for SGWC process crashes or automatic restarts

Monitoring Recommendations

Enable detailed logging for the SGWC component to capture potential exploitation attempts
Implement network-level monitoring on S5-C interface traffic for volumetric or pattern anomalies
Set up automated alerts for SGWC service health degradation
Monitor system resource utilization (memory, CPU) for the Open5GS processes

How to Mitigate CVE-2026-1522

Immediate Actions Required

Apply the security patch b19cf6a to all affected Open5GS installations immediately
Upgrade Open5GS to a version newer than 2.7.6 that includes the fix
Implement network segmentation to restrict access to the S5-C interface
Review firewall rules to limit exposure of SGWC interfaces to trusted networks only

Patch Information

The Open5GS development team has released a fix for this vulnerability in commit b19cf6a. The issue has been flagged as already-fixed in the upstream repository. Organizations running affected versions should update to the latest Open5GS release or apply the specific patch from the GitHub commit.

Additional details about the vulnerability and fix can be found in the GitHub Issue #4266.

Workarounds

Restrict network access to the SGWC S5-C interface to only authorized network elements
Implement rate limiting on incoming connections to the SGWC component
Deploy network intrusion detection systems (IDS) to identify potential exploitation attempts
Consider temporary isolation of vulnerable SGWC instances until patching is complete

bash

# Configuration example - Network access restriction for SGWC
# Restrict S5-C interface access using iptables
iptables -A INPUT -p udp --dport 2123 -s <trusted_pgw_ip> -j ACCEPT
iptables -A INPUT -p udp --dport 2123 -j DROP

# Monitor SGWC service status
systemctl status open5gs-sgwcd

# Check logs for potential exploitation attempts
journalctl -u open5gs-sgwcd | grep -i "modify_bearer_response\|error\|crash"