CVE-2026-7708 Overview
CVE-2026-7708 is a denial of service vulnerability in Open5GS through version 2.7.7. The flaw resides in the ogs_dbi_subscription_data function within /lib/dbi/subscription.c, a component of the Unified Data Repository (UDR). Attackers can trigger the issue remotely by manipulating the supi_id argument. The vulnerability is classified under [CWE-404] (Improper Resource Shutdown or Release). The exploit has been publicly disclosed. The Open5GS project was notified through an issue report but has not yet responded.
Critical Impact
Authenticated remote attackers can degrade the availability of Open5GS UDR services by manipulating the supi_id parameter, disrupting 5G core subscriber data operations.
Affected Products
- Open5GS versions up to and including 2.7.7
- Open5GS UDR (Unified Data Repository) component
- Deployments using /lib/dbi/subscription.c subscription data handling
Discovery Timeline
- 2026-05-03 - CVE-2026-7708 published to NVD
- 2026-05-05 - Last updated in NVD database
Technical Details for CVE-2026-7708
Vulnerability Analysis
The vulnerability affects the ogs_dbi_subscription_data function in the Open5GS database interface library. This function handles subscription data retrieval within the UDR, a core network function in 5G architectures that stores subscriber data. Improper handling of the supi_id argument leads to a denial of service condition consistent with [CWE-404] resource management weaknesses.
Open5GS is an open-source implementation of 5G Core and EPC components. The UDR component is critical for subscriber authentication and session management. A disruption in this component impacts service availability for connected mobile subscribers and dependent network functions such as the UDM (Unified Data Management).
Root Cause
The root cause is improper resource shutdown or release in the ogs_dbi_subscription_data function. When a crafted supi_id value is processed, the function fails to manage allocated resources correctly, leading to service disruption. The defect is located in the database interface layer that mediates between the UDR and the underlying subscription data store.
Attack Vector
The attack is initiated over the network and requires low-level privileges to interact with the UDR interface. An attacker submits a manipulated supi_id argument to the vulnerable function, triggering the resource handling defect. No user interaction is required. Successful exploitation impacts availability without affecting confidentiality or integrity of subscriber data.
No verified proof-of-concept code is available in the enriched data. Refer to the GitHub Issue #4412 and VulDB Vulnerability #360884 for additional technical context.
Detection Methods for CVE-2026-7708
Indicators of Compromise
- Unexpected crashes or restarts of the Open5GS UDR process
- Abnormal subscription data query patterns containing malformed or unusual supi_id values
- Spikes in failed UDM-to-UDR transactions correlating with UDR unavailability
Detection Strategies
- Monitor Open5GS UDR process logs for abnormal terminations or error traces referencing ogs_dbi_subscription_data
- Inspect Service-Based Interface (SBI) traffic for malformed SUPI identifiers in Nudr_DataRepository requests
- Correlate UDR availability metrics with inbound request patterns to identify exploitation attempts
Monitoring Recommendations
- Enable verbose logging on the UDR network function and forward logs to a centralized analytics platform
- Track availability metrics for the UDR and dependent network functions such as UDM and AUSF
- Establish baselines for supi_id value formats and alert on deviations
How to Mitigate CVE-2026-7708
Immediate Actions Required
- Restrict network access to the Open5GS UDR Service-Based Interface to trusted internal 5G core components only
- Audit and tighten authentication and authorization controls on UDR endpoints
- Monitor the Open5GS GitHub repository for an upstream fix and patch promptly when released
Patch Information
No official patch has been released at the time of publication. The Open5GS project was notified through GitHub Issue #4412 but has not yet responded. Operators should track the issue and the upstream repository for fix availability.
Workarounds
- Deploy the UDR behind a service mesh or API gateway that validates supi_id parameter format before forwarding requests
- Apply rate limiting on Nudr_DataRepository requests to reduce the impact of repeated exploitation attempts
- Segment the 5G core network so that only authorized network functions can reach the UDR interface
- Implement process supervision to automatically restart the UDR service if it terminates unexpectedly
# Example: restrict UDR SBI port access using iptables to trusted core network functions only
iptables -A INPUT -p tcp --dport 7777 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7777 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
