CVE-2026-7536: Open5GS BSF Denial of Service Vulnerability

CVE-2026-7536 Overview

CVE-2026-7536 is a denial of service vulnerability in Open5GS versions up to 2.7.7. The flaw resides in the bsf_sess_add_by_ip_address function within the /nbsf-management/v1/pcfBindings endpoint of the Binding Support Function (BSF) component. Attackers can manipulate the ipv4Addr argument to trigger the denial of service condition. The vulnerability is exploitable remotely without authentication or user interaction. The exploit has been publicly disclosed, increasing the risk of opportunistic attacks against exposed Open5GS deployments. The Open5GS project was notified through an issue report but has not yet responded at the time of disclosure.

Critical Impact
Remote unauthenticated attackers can disrupt the availability of the BSF component in 5G core network deployments running Open5GS, impacting policy binding operations.

Affected Products

Open5GS versions up to and including 2.7.7
Open5GS Binding Support Function (BSF) component
Deployments exposing the /nbsf-management/v1/pcfBindings endpoint

Discovery Timeline

2026-05-01 - CVE-2026-7536 published to NVD
2026-05-01 - Last updated in NVD database

Technical Details for CVE-2026-7536

Vulnerability Analysis

Open5GS is an open-source implementation of 5G core network functions. The Binding Support Function (BSF) maintains bindings between User Equipment (UE) IP addresses and the Policy Control Function (PCF) instance serving them. The vulnerability is classified under [CWE-404] Improper Resource Shutdown or Release. It affects the bsf_sess_add_by_ip_address function, which processes session creation requests for PCF bindings. Crafted input to the ipv4Addr parameter causes resource handling failures that result in denial of service. The attack targets a Service-Based Interface (SBI) endpoint that is reachable over the network within the 5G core.

Root Cause

The root cause is improper resource management in the bsf_sess_add_by_ip_address function when handling the ipv4Addr argument supplied to the /nbsf-management/v1/pcfBindings endpoint. The function does not adequately validate or release resources tied to the supplied IPv4 address input, leading to a condition that disrupts the availability of the BSF service. The flaw is reachable through standard 3GPP-defined Nbsf management API calls.

Attack Vector

The vulnerability is exploited remotely over the network. An attacker who can reach the BSF management interface sends a manipulated HTTP request to /nbsf-management/v1/pcfBindings with a crafted ipv4Addr value. No authentication, privileges, or user interaction are required. Successful exploitation degrades or halts BSF operations, affecting policy binding lookups across the 5G core. Since the proof of concept is public, exposed BSF endpoints face elevated risk. The vulnerability mechanism is documented in GitHub Issue #4400 and the VulDB Vulnerability #360353 entry. Refer to those advisories for technical details — no verified exploit code is reproduced here.

Detection Methods for CVE-2026-7536

Indicators of Compromise

HTTP requests to the /nbsf-management/v1/pcfBindings endpoint containing malformed or unusual ipv4Addr values
Unexpected restarts, crashes, or unresponsiveness of the Open5GS BSF process
Spikes in BSF resource utilization correlated with inbound Nbsf management traffic from unauthorized sources

Detection Strategies

Inspect application logs for failed bsf_sess_add_by_ip_address calls and abnormal session creation patterns
Deploy network monitoring on SBI traffic to flag malformed JSON payloads targeting pcfBindings
Correlate BSF service availability metrics with incoming requests to identify exploitation attempts

Monitoring Recommendations

Alert on repeated requests to /nbsf-management/v1/pcfBindings from unexpected source addresses outside the 5G core trust boundary
Monitor process supervisors (systemd, Kubernetes liveness probes) for BSF restarts and capture associated request logs
Track 5G core function health using OAM telemetry and trigger investigation on BSF availability degradation

How to Mitigate CVE-2026-7536

Immediate Actions Required

Restrict network access to the BSF /nbsf-management/v1/pcfBindings endpoint to authorized PCF instances only
Place the Open5GS SBI behind a service mesh or API gateway that enforces mutual TLS and input validation
Audit existing Open5GS deployments for version 2.7.7 or earlier and prepare for emergency patching once a fix is released

Patch Information

No official patch is available at the time of publication. According to the disclosure, the Open5GS project was informed through an issue report but has not responded. Track GitHub Issue #4400 and the Open5GS repository for fix availability.

Workarounds

Apply network ACLs or firewall rules limiting Nbsf management traffic to trusted internal 5G core network functions
Enable strict input validation at an upstream reverse proxy to reject malformed ipv4Addr values before they reach BSF
Deploy rate limiting on the BSF management endpoint to reduce exposure to repeated exploitation attempts

bash

# Example iptables rule restricting BSF SBI access to the PCF subnet
iptables -A INPUT -p tcp --dport 7777 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7777 -j DROP