CVE-2026-4240: Open5GS CCA Handler DoS Vulnerability

CVE-2026-4240 Overview

A denial of service vulnerability has been identified in Open5GS up to version 2.7.6. The affected element is the CCA Handler component, specifically the functions smf_gx_cca_cb, smf_gy_cca_cb, smf_s6b_aaa_cb, and smf_s6b_sta_cb. This vulnerability allows an attacker to remotely trigger a crash in the Session Management Function (SMF) when sending a Credit-Control-Answer (CCA) message with an unknown Diameter session, causing service disruption.

Critical Impact

Remote attackers can crash the Open5GS SMF component, disrupting 5G core network services and potentially affecting all users relying on the affected infrastructure.

Affected Products

• Open5GS versions up to 2.7.6
• Open5GS SMF (Session Management Function) component
• Systems utilizing Gx, Gy, and S6b Diameter interfaces

Discovery Timeline

• 2026-03-16 - CVE-2026-4240 published to NVD
• 2026-03-16 - Last updated in NVD database

Technical Details for CVE-2026-4240

Vulnerability Analysis

This vulnerability represents an Improper Resource Shutdown or Release issue (CWE-404) in Open5GS's SMF component. The SMF is a critical element in 5G core networks, responsible for session management, IP address allocation, and policy enforcement. When the SMF receives a Credit-Control-Answer (CCA) message referencing an unknown Diameter session, the callback handlers fail to properly validate the session before processing, leading to a crash condition.

The exploit has been publicly disclosed through the Open5GS issue tracker, making this vulnerability particularly concerning for operators running unpatched Open5GS deployments. The network-accessible nature of this flaw means attackers can target the SMF remotely without requiring authentication or user interaction.

Root Cause

The root cause stems from improper resource handling in the CCA callback functions. When the SMF receives a CCA message, the handlers smf_gx_cca_cb, smf_gy_cca_cb, smf_s6b_aaa_cb, and smf_s6b_sta_cb fail to validate whether the referenced Diameter session exists before attempting to process the response. This missing validation leads to a null pointer dereference or invalid memory access when the handlers attempt to operate on a non-existent session context.

Attack Vector

An attacker can exploit this vulnerability by sending crafted CCA messages over the Diameter protocol interfaces (Gx, Gy, or S6b) referencing session identifiers that do not exist in the SMF's session table. The attack can be initiated remotely across the network, targeting the Diameter interfaces exposed by the SMF. Since no authentication is required at the Diameter message level for this attack, any network entity capable of sending Diameter messages to the SMF can trigger the vulnerability.

/* Security patch in src/smf/gx-path.c */
/* Gx Interface, 3GPP TS 29.212 section 4
- * Copyright (C) 2019-2025 by Sukchan Lee <acetcom@gmail.com>
+ * Copyright (C) 2019-2026 by Sukchan Lee <acetcom@gmail.com>
 *
 * This file is part of Open5GS.
 *

Source: GitHub Open5GS Commit

/* Security patch in src/smf/gy-path.c */
/* Gy Interface, 3GPP TS 32.299
 * Copyright (C) 2019 by Sukchan Lee <acetcom@gmail.com>
 * Copyright (C) 2022 by sysmocom - s.f.m.c. GmbH <info@sysmocom.de>
- * Copyright (C) 2025 by Sukchan Lee <acetcom@gmail.com>
+ * Copyright (C) 2025-2026 by Sukchan Lee <acetcom@gmail.com>
 *
 * This file is part of Open5GS.
 *

Source: GitHub Open5GS Commit

Detection Methods for CVE-2026-4240

Indicators of Compromise

• Unexpected SMF process crashes or restarts in Open5GS deployments
• Diameter CCA messages received with session IDs not present in the active session table
• Increased error logs related to Gx, Gy, or S6b interface handlers
• Service disruption patterns affecting PDU session establishment or modification

Detection Strategies

• Monitor Open5GS SMF logs for crash events and core dumps related to CCA handler functions
• Implement Diameter protocol monitoring to detect anomalous CCA messages with invalid session references
• Deploy network traffic analysis on Gx, Gy, and S6b interfaces to identify unusual patterns
• Configure process monitoring and automatic alerting for SMF component failures

Monitoring Recommendations

• Enable enhanced logging for Diameter interface communications in Open5GS
• Implement real-time monitoring of SMF process health and availability
• Set up alerting thresholds for SMF restart frequency to detect active exploitation attempts
• Review Diameter peer connections for unexpected or unauthorized sources

How to Mitigate CVE-2026-4240

Immediate Actions Required

• Upgrade Open5GS to version 2.7.7 or later immediately
• Review Diameter peer configurations and restrict access to trusted network elements only
• Implement network segmentation to limit exposure of Diameter interfaces
• Enable enhanced logging to detect any exploitation attempts before patching

Patch Information

The vulnerability has been fixed in Open5GS version 2.7.7. The security patch (commit 80eb484a6ab32968e755e628b70d1a9c64f012ec) adds proper session validation in the CCA callback handlers to prevent crashes when receiving messages with unknown Diameter sessions. The fix ensures that the SMF validates session existence before processing CCA responses, returning an appropriate error rather than crashing.

For detailed patch information, refer to the Open5GS v2.7.7 Release Notes.

Workarounds

• Implement firewall rules to restrict Diameter protocol access to known and trusted peer nodes only
• Deploy network ACLs on Gx, Gy, and S6b interfaces to limit exposure
• Consider deploying a Diameter proxy or firewall that can validate session references before forwarding to SMF
• Implement process monitoring with automatic restart to minimize service disruption if exploitation occurs

# Example: Restrict Diameter interface access using iptables
# Allow Diameter traffic only from trusted PCRF/OCS peers
iptables -A INPUT -p tcp --dport 3868 -s <trusted_pcrf_ip> -j ACCEPT
iptables -A INPUT -p tcp --dport 3868 -s <trusted_ocs_ip> -j ACCEPT
iptables -A INPUT -p tcp --dport 3868 -j DROP

# Enable SMF process monitoring with systemd
systemctl enable open5gs-smfd
systemctl start open5gs-smfd