CVE-2026-71675 Overview
CVE-2026-71675 affects Open5GS v2.7.0, an open-source implementation of the 5G Core and EPC. A remote attacker can trigger a denial of service (DoS) condition through the ngap_send_to_nas() function located in src/amf/ngap-path.c. The flaw is classified under [CWE-401] (Missing Release of Memory After Effective Lifetime), indicating a memory leak issue within the Access and Mobility Management Function (AMF).
The vulnerability is network-exploitable without authentication or user interaction, impacting availability of the 5G core signaling plane.
Critical Impact
Remote unauthenticated attackers can exhaust AMF resources, disrupting NGAP signaling and impairing subscriber connectivity across the 5G core.
Affected Products
- Open5GS v2.7.0
- Open5GS AMF component (src/amf/ngap-path.c)
- 5G core deployments relying on the affected NGAP path
Discovery Timeline
- 2026-08-18 - CVE-2026-71675 published to NVD
- 2026-08-19 - Last updated in NVD database
Technical Details for CVE-2026-71675
Vulnerability Analysis
The vulnerability resides in the ngap_send_to_nas() function inside src/amf/ngap-path.c. This function handles NG Application Protocol (NGAP) messages destined for the Non-Access Stratum (NAS) layer within the AMF. According to the advisory, a remote attacker can send crafted traffic that causes the AMF process to leak memory during message handling.
Because the AMF is central to 5G control-plane signaling, sustained memory leakage degrades availability. Repeated exploitation can exhaust process memory, forcing the AMF to slow or terminate. This disrupts UE registration, session management, and handover operations across the served network slice.
Root Cause
The root cause is a missing release of allocated memory after its effective lifetime, consistent with [CWE-401]. Message buffers or associated structures processed within ngap_send_to_nas() are not freed on all execution paths, allowing an attacker to trigger repeated allocations that are never reclaimed.
Attack Vector
Exploitation requires network reachability to the AMF NGAP interface. No privileges or user interaction are needed. An attacker with the ability to deliver NGAP-formatted traffic to the AMF can invoke the vulnerable code path repeatedly to accumulate leaked memory until service degradation occurs.
A proof-of-concept has been published; see the GitHub Gist PoC Repository for technical details. No verified exploitation code is reproduced here.
Detection Methods for CVE-2026-71675
Indicators of Compromise
- Steady, unexplained growth in AMF process resident memory over time without a corresponding increase in active subscribers.
- Repeated NGAP messages from a single peer or unexpected source triggering NAS forwarding paths.
- AMF restarts, out-of-memory kills, or degraded NGAP responsiveness under otherwise normal load.
Detection Strategies
- Baseline AMF memory usage and alert on deviations that persist beyond expected traffic patterns.
- Inspect NGAP peer sessions for anomalous message rates or malformed NAS payloads.
- Correlate AMF crash or restart events with preceding NGAP traffic spikes in centralized logs.
Monitoring Recommendations
- Enable verbose logging around ngap_send_to_nas() and monitor for repeated invocations tied to specific peers.
- Ingest AMF process metrics (RSS, heap size, uptime) into a monitoring platform to detect slow leaks.
- Track NGAP interface counters for unusual message distributions and drop rates.
How to Mitigate CVE-2026-71675
Immediate Actions Required
- Inventory Open5GS deployments and identify AMF instances running version 2.7.0.
- Restrict NGAP interface exposure to trusted gNB peers using network segmentation and firewall rules.
- Implement rate limiting on NGAP traffic where feasible to slow exploitation attempts.
Patch Information
No patch reference was included in the NVD entry at publication. Administrators should track the Open5GS project for updates addressing the memory leak in ngap_send_to_nas() and upgrade to a fixed release once available. Review the GitHub Gist PoC Repository for reproduction details when validating fixes.
Workarounds
- Isolate the AMF NGAP endpoint behind access control lists limiting connectivity to authorized gNBs.
- Deploy process supervision that restarts the AMF on memory thresholds to reduce impact until patched.
- Monitor upstream commits and community advisories for interim patches to the affected function.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
