CVE-2026-1522: Open5GS SGWC Denial of Service Vulnerability

CVE-2026-1522 Overview

A denial of service vulnerability has been identified in Open5GS versions up to 2.7.6. This vulnerability affects the function sgwc_s5c_handle_modify_bearer_response within the file src/sgwc/s5c-handler.c of the SGWC (Serving Gateway Control Plane) component. The vulnerability allows remote attackers to cause a denial of service condition through improper resource shutdown or release, classified under CWE-404.

Critical Impact

Remote attackers can exploit this vulnerability to disrupt 5G core network services by causing denial of service conditions in the SGWC component, potentially affecting mobile network connectivity and service availability.

Affected Products

• Open5GS versions up to and including 2.7.6
• SGWC (Serving Gateway Control Plane) component
• Systems running vulnerable s5c-handler.c implementations

Discovery Timeline

• 2026-01-28 - CVE-2026-1522 published to NVD
• 2026-01-29 - Last updated in NVD database

Technical Details for CVE-2026-1522

Vulnerability Analysis

This vulnerability resides in the Open5GS SGWC component, specifically within the sgwc_s5c_handle_modify_bearer_response function located in src/sgwc/s5c-handler.c. Open5GS is an open-source implementation of 5G Core and EPC (Evolved Packet Core) networks, making this vulnerability particularly significant for telecommunications infrastructure.

The flaw is categorized as CWE-404: Improper Resource Shutdown or Release. This class of vulnerability occurs when a system fails to properly release or shut down resources when they are no longer needed, which can lead to resource exhaustion and subsequent denial of service conditions.

The vulnerability can be exploited remotely over the network without requiring any authentication or user interaction. An exploit has been made publicly available, increasing the risk of active exploitation attempts against unpatched systems.

Root Cause

The root cause of this vulnerability is improper resource shutdown or release (CWE-404) within the sgwc_s5c_handle_modify_bearer_response function. When processing modify bearer response messages on the S5-C interface, the function fails to properly manage resources, allowing attackers to trigger conditions that exhaust system resources or cause the service to become unresponsive.

Attack Vector

The attack can be launched remotely over the network targeting the SGWC component's S5-C interface. The S5-C interface is the control plane interface between the Serving Gateway (SGW) and Packet Data Network Gateway (PGW) in 4G/5G networks. An attacker with network access to this interface can send specially crafted modify bearer response messages to trigger the vulnerability.

The vulnerability has been addressed in commit b19cf6a. Technical details regarding the specific exploitation mechanism can be found in the GitHub Issue Tracker Entry and the associated patch commit.

Detection Methods for CVE-2026-1522

Indicators of Compromise

• Unexpected crashes or restarts of the SGWC service
• Abnormal resource consumption (memory or CPU) by the Open5GS SGWC process
• Unusual patterns of modify bearer response messages on the S5-C interface
• Service unavailability affecting mobile network connectivity

Detection Strategies

• Monitor SGWC service health and availability metrics for unexpected degradation
• Implement network traffic analysis for anomalous S5-C interface communications
• Deploy log monitoring for error patterns related to sgwc_s5c_handle_modify_bearer_response function
• Configure alerting for SGWC process crashes or automatic restarts

Monitoring Recommendations

• Enable detailed logging for the SGWC component to capture potential exploitation attempts
• Implement network-level monitoring on S5-C interface traffic for volumetric or pattern anomalies
• Set up automated alerts for SGWC service health degradation
• Monitor system resource utilization (memory, CPU) for the Open5GS processes

How to Mitigate CVE-2026-1522

Immediate Actions Required

• Apply the security patch b19cf6a to all affected Open5GS installations immediately
• Upgrade Open5GS to a version newer than 2.7.6 that includes the fix
• Implement network segmentation to restrict access to the S5-C interface
• Review firewall rules to limit exposure of SGWC interfaces to trusted networks only

Patch Information

The Open5GS development team has released a fix for this vulnerability in commit b19cf6a. The issue has been flagged as already-fixed in the upstream repository. Organizations running affected versions should update to the latest Open5GS release or apply the specific patch from the GitHub commit.

Additional details about the vulnerability and fix can be found in the GitHub Issue #4266.

Workarounds

• Restrict network access to the SGWC S5-C interface to only authorized network elements
• Implement rate limiting on incoming connections to the SGWC component
• Deploy network intrusion detection systems (IDS) to identify potential exploitation attempts
• Consider temporary isolation of vulnerable SGWC instances until patching is complete

# Configuration example - Network access restriction for SGWC
# Restrict S5-C interface access using iptables
iptables -A INPUT -p udp --dport 2123 -s <trusted_pgw_ip> -j ACCEPT
iptables -A INPUT -p udp --dport 2123 -j DROP

# Monitor SGWC service status
systemctl status open5gs-sgwcd

# Check logs for potential exploitation attempts
journalctl -u open5gs-sgwcd | grep -i "modify_bearer_response\|error\|crash"