CVE-2026-71676: Open5GS Buffer Overflow DoS Vulnerability

CVE-2026-71676 Overview

CVE-2026-71676 is a heap-based buffer overflow vulnerability in Open5GS version 2.7.0. The flaw resides in the Non-Access Stratum (NAS) 5GS decoder chain and is triggered when the message type byte of a NAS Protocol Data Unit (PDU) is mutated. A remote unauthenticated attacker can exploit this condition to cause a denial of service against the affected 5G core network function. The vulnerability is tracked under CWE-122 (Heap-based Buffer Overflow) and affects a critical component of open-source 5G mobile core infrastructure.

Critical Impact
Remote attackers can crash Open5GS 5G core components without authentication or user interaction, disrupting mobile network availability for connected subscribers.

Affected Products

Open5GS version 2.7.0
5G core network functions (AMF) parsing NAS 5GS messages
Deployments exposing the NAS decoder to untrusted radio or network input

Discovery Timeline

2026-08-18 - CVE-2026-71676 published to the National Vulnerability Database (NVD)
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-71676

Vulnerability Analysis

Open5GS implements the 3GPP NAS 5GS protocol used between User Equipment (UE) and the Access and Mobility Management Function (AMF). The decoder chain dispatches parsing routines based on the message type byte located in the NAS PDU header. When this byte is mutated to an unexpected value, the decoder writes beyond the bounds of an allocated heap buffer, corrupting adjacent memory and crashing the process. The reachable attack surface makes this a network-exposed availability issue against 5G core infrastructure. Public proof-of-concept material is referenced through a GitHub Gist PoC.

Root Cause

The root cause is insufficient validation of the NAS message type byte before dispatch into type-specific decoder handlers. The decoder assumes a bounded set of valid message types and does not enforce length or type sanity across the full decoding path. A mutated type byte routes execution to a handler that reads or writes past the actual payload length, producing a heap-based buffer overflow classified as [CWE-122].

Attack Vector

An attacker sends a crafted NAS 5GS PDU with a manipulated message type byte to the AMF or another Open5GS function that terminates NAS signaling. No authentication, user interaction, or privileges are required. Successful exploitation terminates the process, denying service to all subscribers depending on that core function.

No verified exploitation code is published beyond the referenced Gist. See the linked proof-of-concept for the mutation strategy applied to NAS PDU fuzzing.

Detection Methods for CVE-2026-71676

Indicators of Compromise

Unexpected crashes, restarts, or core dumps of the open5gs-amfd process or related NAS-terminating daemons
NAS 5GS PDUs containing message type values outside documented 3GPP TS 24.501 ranges
Repeated malformed NAS signaling attempts from a single peer or gNB source

Detection Strategies

Deploy network monitoring on N1/N2 interfaces to flag NAS PDUs with anomalous message type bytes
Enable process-level supervision and alert on abnormal exits of Open5GS daemons
Correlate signaling anomalies with subscriber attach failures in AMF logs

Monitoring Recommendations

Aggregate Open5GS logs, syslog crash signatures, and NGAP/NAS decoder errors into a centralized SIEM
Track baseline NAS message type distributions and alert on statistical deviations
Monitor for repeated AbortSignal or segmentation fault entries in systemd journal output tied to Open5GS units

How to Mitigate CVE-2026-71676

Immediate Actions Required

Upgrade Open5GS to a version later than 2.7.0 once a fixed release is published by the maintainers
Restrict N2 and NAS-facing interfaces to trusted gNB peers using network segmentation and firewall rules
Enable process supervision with automatic restart to reduce the duration of denial-of-service conditions

Patch Information

No vendor advisory URL is listed in the NVD entry at the time of publication. Monitor the Open5GS project repository for a fixed release addressing the NAS decoder chain and rebuild affected deployments once available.

Workarounds

Place a NAS-aware signaling filter or IDS in front of the AMF to drop PDUs with invalid message type bytes
Limit peering to authenticated gNBs and disable exposure of the NAS interface to untrusted networks
Apply operating system hardening such as heap protections and Address Space Layout Randomization (ASLR) to raise exploitation cost

bash

# Example: restrict AMF NAS interface exposure with nftables
nft add table inet open5gs_filter
nft add chain inet open5gs_filter input { type filter hook input priority 0 \; policy drop \; }
nft add rule inet open5gs_filter input ip saddr { 10.0.0.0/24 } tcp dport 38412 accept
nft add rule inet open5gs_filter input ip saddr { 10.0.0.0/24 } sctp dport 38412 accept