CVE-2026-7779 Overview
CVE-2026-7779 is a denial of service vulnerability in Open5GS versions up to 2.7.7. The flaw resides in the udm_nudr_dr_handle_subscription_authentication function within /src/udm/nudr-handler.c, part of the authentication-subscription endpoint of the Unified Data Management (UDM) component. A remote attacker with low privileges can manipulate input to the endpoint and trigger a denial of service condition. Public exploit details have been released, increasing the risk of opportunistic attacks against exposed 5G core deployments. The Open5GS project was notified through an issue report but has not responded as of disclosure.
Critical Impact
Remote attackers can disrupt subscription authentication processing in the Open5GS UDM, impairing 5G core network availability for connected subscribers.
Affected Products
- Open5GS up to and including version 2.7.7
- Open5GS UDM component (/src/udm/nudr-handler.c)
- Authentication-subscription endpoint within the UDM service
Discovery Timeline
- 2026-05-04 - CVE-2026-7779 published to NVD
- 2026-05-05 - Last updated in NVD database
Technical Details for CVE-2026-7779
Vulnerability Analysis
The vulnerability resides in the udm_nudr_dr_handle_subscription_authentication function in /src/udm/nudr-handler.c. This handler processes responses from the Unified Data Repository (UDR) related to subscription authentication data within the Open5GS 5G core. Manipulated input to the authentication-subscription endpoint causes the UDM service to enter a denial of service state. The issue is classified under [CWE-404] Improper Resource Shutdown or Release, indicating that the function fails to properly manage resources when handling malformed or unexpected data. As a result, repeated exploitation can degrade or interrupt UDM availability, affecting subscriber authentication flows on the 5G core.
Root Cause
The root cause is improper resource handling in the udm_nudr_dr_handle_subscription_authentication function. The handler does not robustly validate or release resources when processing certain authentication-subscription messages. This shortcoming allows attacker-controlled input to disrupt normal execution and consume or leak service resources.
Attack Vector
The attack vector is network-based and requires low privileges. An attacker with reachability to the UDM authentication-subscription endpoint can send crafted requests that trigger the resource handling flaw. No user interaction is needed. Public release of exploit details lowers the barrier for adversaries targeting exposed Open5GS deployments.
No verified public proof-of-concept code is available for inclusion. See the GitHub Issue #4418 and VulDB Vulnerability #360976 for additional technical context.
Detection Methods for CVE-2026-7779
Indicators of Compromise
- Unexpected restarts, crashes, or unresponsive states of the Open5GS udmd process
- Spikes in malformed or anomalous Nudr_DataRepository requests directed at the UDM
- Authentication failures or timeouts reported by AMF/AUSF when querying the UDM
Detection Strategies
- Monitor UDM service logs for errors originating from udm_nudr_dr_handle_subscription_authentication or repeated handler failures.
- Inspect HTTP/2 SBI traffic to the authentication-subscription endpoint for malformed payloads or abnormal request rates.
- Correlate UDM availability metrics with subscriber authentication failure rates to detect early signs of service degradation.
Monitoring Recommendations
- Enable structured logging on Open5GS UDM and ship logs to a centralized analytics platform for anomaly detection.
- Track process uptime, CPU, and memory metrics for the UDM container or host to catch resource exhaustion patterns.
- Alert on repeated 5xx responses or disconnects on the UDM Nudr interface.
How to Mitigate CVE-2026-7779
Immediate Actions Required
- Restrict network access to the Open5GS UDM service so that only trusted 5G core network functions can reach the authentication-subscription endpoint.
- Place the UDM behind segmented service mesh or firewall policies that enforce mutual TLS and source-based access control.
- Increase monitoring of UDM availability and subscriber authentication error rates while a fix is pending.
Patch Information
No official patch is currently available. The Open5GS project has been notified via GitHub Issue #4418 but has not yet responded. Track the Open5GS GitHub repository for updates beyond version 2.7.7 that address the resource handling defect in udm_nudr_dr_handle_subscription_authentication.
Workarounds
- Limit UDM exposure to the internal 5G core service-based interface (SBI) network only, blocking all external reachability.
- Apply rate limiting and request validation at an API gateway or service mesh proxy in front of the UDM.
- Implement automated process supervision to restart the UDM service if it becomes unresponsive, reducing availability impact.
# Example: restrict UDM SBI access to trusted core NFs only (iptables)
iptables -A INPUT -p tcp --dport 7777 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7777 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
