CVE-2026-7706 Overview
CVE-2026-7706 is a denial of service vulnerability in Open5GS versions up to 2.7.7. The flaw resides in the gmm_handle_service_request function within /src/amf/gmm-handler.c, a component of the Access and Mobility Management Function (AMF). An authenticated remote attacker can trigger improper resource handling [CWE-404] to disrupt service availability. The exploit details have been disclosed publicly, increasing the risk of opportunistic exploitation against exposed 5G core deployments. The Open5GS project was notified through an issue report but has not responded at the time of disclosure.
Critical Impact
A remote authenticated attacker can disrupt the AMF component of an Open5GS 5G core, affecting subscriber mobility management and service continuity.
Affected Products
- Open5GS versions up to and including 2.7.7
- Open5GS AMF (Access and Mobility Management Function) component
- Deployments using /src/amf/gmm-handler.c with the vulnerable gmm_handle_service_request handler
Discovery Timeline
- 2026-05-03 - CVE-2026-7706 published to NVD
- 2026-05-05 - Last updated in NVD database
Technical Details for CVE-2026-7706
Vulnerability Analysis
The vulnerability resides in the gmm_handle_service_request function defined in /src/amf/gmm-handler.c. This handler processes 5G NAS Service Request messages from User Equipment (UE) registering or resuming sessions through the AMF. The function fails to properly release or manage resources when handling malformed or unexpected service request messages, mapped to [CWE-404] Improper Resource Shutdown or Release.
When an attacker submits a crafted service request, the AMF process enters an error state without correctly cleaning up associated state or memory. Repeated triggering can degrade or terminate the AMF, interrupting mobility management for all subscribers attached to the affected 5G core. The attack requires low-level authenticated access on the network path, consistent with NAS-layer interaction.
Root Cause
The root cause is improper resource management in the General Mobility Management (GMM) service request handler. The function does not correctly handle all branches of input validation failures, leaving allocated resources or session state inconsistent. This matches the [CWE-404] weakness pattern.
Attack Vector
The vulnerability is reachable over the network through the N1/N2 NAS signaling interface that the AMF exposes. An attacker with valid signaling-plane access submits a malformed Service Request NAS message to the AMF. No user interaction is required. Because Open5GS is widely used in research, lab, and private 5G deployments, exposure depends on operator network segmentation. The vulnerability does not allow code execution, data theft, or integrity changes — only availability impact on the AMF.
No verified public proof-of-concept code is provided in the advisory. See the GitHub Open5GS Issue #4409 and the VulDB Vulnerability #360882 entries for additional technical details as they become available.
Detection Methods for CVE-2026-7706
Indicators of Compromise
- Unexpected AMF process crashes, restarts, or unresponsiveness in Open5GS logs immediately after receiving NAS Service Request messages
- Spikes in malformed or repeated Service Request NAS messages from a single UE or signaling source
- Loss of mobility management service for attached subscribers without corresponding configuration changes
Detection Strategies
- Monitor AMF logs for errors originating in gmm_handle_service_request and correlate with subscriber session disruptions
- Inspect NAS-layer traffic for malformed Service Request messages using packet capture and 5G NAS decoders
- Track AMF resource utilization (memory, file descriptors, session counts) for anomalous growth or sudden drops indicative of resource mishandling
Monitoring Recommendations
- Enable verbose logging on the AMF and forward events to a centralized analytics or SIEM platform for correlation
- Establish baselines for NAS Service Request rates per gNB and alert on deviations
- Configure health checks and watchdogs that detect AMF restarts and trigger investigation workflows
How to Mitigate CVE-2026-7706
Immediate Actions Required
- Restrict network access to the AMF signaling interfaces so that only trusted gNBs and 5G control-plane components can reach it
- Audit Open5GS deployments for version 2.7.7 or earlier and isolate non-production or research instances exposed to untrusted networks
- Increase monitoring on AMF availability and NAS message volumes until an upstream fix is available
Patch Information
No official patch has been released at the time of disclosure. The Open5GS project was informed through an issue report but has not yet responded. Track the GitHub Open5GS Repository and GitHub Open5GS Issue #4409 for fix availability. Apply any vendor-supplied update as soon as it is published and validate the patch in a non-production environment before deploying to production cores.
Workarounds
- Place the AMF behind strict network segmentation and signaling firewalls that allow only authenticated peers
- Apply rate limiting on inbound NAS Service Request messages per source to reduce the impact of repeated triggering
- Deploy AMF instances in a redundant configuration so that a crash of one instance does not cause full service loss
- Disable or limit access to test and lab Open5GS deployments that do not require external reachability
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
