CVE-2026-1587: Open5GS SGWC Denial of Service Vulnerability

CVE-2026-1587 Overview

A denial of service vulnerability has been discovered in Open5GS, an open-source implementation of 5G Core and EPC (Evolved Packet Core). The vulnerability exists in the sgwc_s11_handle_modify_bearer_request function within the /sgwc/s11-handler.c file of the SGWC (Serving Gateway Control Plane) component. This flaw stems from improper resource shutdown or release (CWE-404), which can be exploited remotely to cause service disruption without requiring authentication.

Critical Impact

Remote attackers can exploit this vulnerability to disrupt SGWC services in Open5GS deployments, potentially affecting 5G/LTE network availability and subscriber connectivity.

Affected Products

• Open5GS versions up to 2.7.6
• SGWC (Serving Gateway Control Plane) component
• Deployments utilizing the S11 interface for GTP-C signaling

Discovery Timeline

• 2026-01-29 - CVE-2026-1587 published to NVD
• 2026-01-29 - Last updated in NVD database

Technical Details for CVE-2026-1587

Vulnerability Analysis

This vulnerability is classified as an Improper Resource Shutdown or Release issue (CWE-404) affecting the SGWC component of Open5GS. The vulnerable function sgwc_s11_handle_modify_bearer_request is responsible for processing Modify Bearer Request messages on the S11 interface, which handles GTP-C (GPRS Tunneling Protocol - Control Plane) signaling between the MME (Mobility Management Entity) and the Serving Gateway.

The flaw allows remote attackers to trigger a denial of service condition by sending specially crafted requests to the SGWC service. The issue has been flagged as already-fixed in the issue tracker, indicating that the Open5GS maintainers have addressed the root cause. The exploit has been publicly disclosed, increasing the risk for unpatched deployments.

Root Cause

The root cause is improper resource management in the sgwc_s11_handle_modify_bearer_request function. When handling Modify Bearer Request messages, the function fails to properly release or shutdown resources under certain conditions, leading to resource exhaustion or service instability. This type of vulnerability typically occurs when error handling paths do not properly clean up allocated resources, or when the function does not validate input parameters before processing, allowing malformed requests to trigger abnormal behavior.

Attack Vector

The attack can be initiated remotely over the network without requiring authentication or user interaction. An attacker with network access to the SGWC S11 interface can send malformed or specially crafted Modify Bearer Request GTP-C messages to trigger the vulnerability. In telecommunications environments, the S11 interface typically operates on internal network segments, but misconfigurations or compromised network positions could expose this attack surface.

The exploitation mechanism involves sending requests that cause the vulnerable function to fail in its resource management, ultimately leading to service degradation or complete denial of service for the SGWC component.

Detection Methods for CVE-2026-1587

Indicators of Compromise

• Unusual volume of Modify Bearer Request messages targeting the SGWC component
• SGWC process crashes or unexpected restarts without scheduled maintenance
• Resource exhaustion symptoms (memory leaks, file descriptor exhaustion) in the SGWC service
• Abnormal GTP-C signaling patterns on the S11 interface

Detection Strategies

• Monitor SGWC process stability and implement alerting for unexpected service restarts
• Deploy network intrusion detection rules to identify malformed GTP-C Modify Bearer Request messages
• Implement rate limiting and anomaly detection on the S11 interface
• Review SGWC logs for error messages related to the sgwc_s11_handle_modify_bearer_request function

Monitoring Recommendations

• Enable detailed logging for the SGWC component to capture error conditions in s11-handler processing
• Establish baseline metrics for GTP-C message processing and alert on significant deviations
• Monitor system resource utilization (memory, CPU, file descriptors) for the SGWC process
• Implement health check probes that verify SGWC responsiveness to legitimate requests

How to Mitigate CVE-2026-1587

Immediate Actions Required

• Upgrade Open5GS to a version newer than 2.7.6 that includes the security fix
• Review and restrict network access to the S11 interface to trusted MME endpoints only
• Implement monitoring for SGWC service availability and automated recovery procedures
• Consider deploying redundant SGWC instances to maintain service continuity during potential attacks

Patch Information

The vulnerability has been reported as already-fixed by the Open5GS maintainers. Users should consult the GitHub Issue Discussion for specific patch details and update to the latest stable release that incorporates the fix. Additional vulnerability tracking information is available at VulDB #343350.

Workarounds

• Implement strict network segmentation to limit access to the S11 interface from untrusted networks
• Deploy a firewall or security appliance to filter and rate-limit GTP-C traffic to the SGWC
• Enable process supervision (e.g., systemd watchdog) to automatically restart the SGWC service if it becomes unresponsive
• Consider deploying an application-layer gateway to validate GTP-C messages before they reach the SGWC

# Example: Restrict S11 interface access using iptables
# Replace 10.0.0.0/24 with your trusted MME network range
# Replace 2123 with your SGWC S11 port if different

iptables -A INPUT -p udp --dport 2123 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p udp --dport 2123 -j DROP