CVE-2026-7780 Overview
CVE-2026-7780 affects Open5GS releases up to and including version 2.7.7. The flaw resides in the udm_state_operational function within /src/udm/udm-sm.c, part of the smf-registrations endpoint of the Unified Data Management (UDM) component. An attacker with low privileges can send crafted network input to trigger a denial of service against the UDM process. The weakness is classified under CWE-404: Improper Resource Shutdown or Release. Public exploit details have been disclosed, and the Open5GS maintainers were notified through a public issue report but had not responded at the time of publication.
Critical Impact
Remote authenticated attackers can disrupt 5G core UDM services, degrading subscriber registration and session management for connected user equipment.
Affected Products
- Open5GS up to and including version 2.7.7
- UDM component (/src/udm/udm-sm.c)
- smf-registrations endpoint exposed by the UDM Network Function
Discovery Timeline
- 2026-05-04 - CVE-2026-7780 published to NVD
- 2026-05-05 - Last updated in NVD database
Technical Details for CVE-2026-7780
Vulnerability Analysis
Open5GS is an open-source implementation of the 5G Core and EPC. The UDM Network Function manages subscriber data and authentication credentials within the Service Based Architecture (SBA). The udm_state_operational state handler in udm-sm.c processes Service Based Interface (SBI) messages directed at the smf-registrations resource. A specific manipulation of input handled by this state machine causes the UDM process to fail to release resources correctly, leading to a denial-of-service condition consistent with CWE-404.
Because the UDM is a central component for subscriber identity in a 5G core, disruption cascades into AMF and SMF workflows that depend on UDM responses for registration and PDU session establishment. The flaw does not enable code execution or data disclosure based on the available scoring vector.
Root Cause
The defect lies in the operational state handler for SMF registration messages. The function does not adequately manage resources tied to incoming SBI requests, allowing a malformed or unexpected sequence to leave the UDM unable to continue normal service. The condition is reproducible from the network and requires only low privileges typical of an authenticated peer Network Function on the SBA.
Attack Vector
The attack surface is the HTTP/2 SBI exposed by the UDM smf-registrations endpoint. An attacker who can reach this interface, such as a compromised or rogue Network Function inside the 5G core service mesh, can submit the triggering request remotely. Operator complexity is low, no user interaction is required, and the result is loss of UDM availability. Public exploit material is referenced through the Open5GS issue tracker and the VulDB entry for vulnerability #360977.
No verified proof-of-concept code is reproduced here. Refer to the linked issue and VulDB references for technical specifics.
Detection Methods for CVE-2026-7780
Indicators of Compromise
- Unexpected termination, restart loops, or hung worker threads in the Open5GS UDM process logs
- Anomalous HTTP/2 SBI traffic to the UDM smf-registrations resource originating from unexpected source NFs
- Spikes in 5xx or transport-reset responses returned by UDM to AMF/SMF peers
Detection Strategies
- Monitor UDM application logs for assertion failures or abnormal state transitions in udm_state_operational
- Correlate AMF and SMF SBI errors with UDM availability gaps to surface upstream DoS conditions
- Inspect SBI request payloads at the service mesh proxy for malformed smf-registrations operations
Monitoring Recommendations
- Track UDM process uptime, CPU, and memory metrics with alerting on abrupt restarts
- Capture NetFlow or service-mesh telemetry between Network Functions to identify abnormal request volumes targeting UDM
- Forward Open5GS logs to a centralized analytics platform for correlation with control-plane KPIs
How to Mitigate CVE-2026-7780
Immediate Actions Required
- Restrict network reachability of the UDM SBI to authorized Network Functions only, using mTLS and network policies
- Track the Open5GS issue #4419 and the Open5GS repository for upstream fixes
- Increase monitoring sensitivity on UDM availability to shorten time to detect exploitation attempts
Patch Information
No vendor patch had been published at the time of CVE assignment. The project was notified through a public issue report but had not responded. Operators should subscribe to the Open5GS repository for release notifications and apply security updates promptly once available. Refer to the VulDB advisory #360977 for ongoing tracking of remediation status.
Workarounds
- Place the UDM behind a service-mesh proxy that enforces strict schema validation on smf-registrations requests
- Apply rate limiting and per-peer quotas at the SBI ingress to constrain abusive request patterns
- Deploy supervised process management so that UDM crashes are auto-restarted while alerting is generated
- Segment the 5G core control plane so that only vetted AMF and SMF instances can reach UDM endpoints
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
