CVE-2026-78186: Open5GS HSS Component RCE Vulnerability

CVE-2026-78186 Overview

CVE-2026-78186 is a reachable assertion vulnerability [CWE-617] in Open5GS versions up to 2.8.0. The flaw resides in the Home Subscriber Server (HSS) component, specifically in src/hss/hss-cx-path.c. An attacker can trigger the assertion by manipulating the User-Name Attribute-Value Pair (AVP) in a Cx interface Diameter request. Successful exploitation causes the HSS process to abort, resulting in a denial-of-service condition against the IP Multimedia Subsystem (IMS) authentication path. The issue is remotely reachable and a public exploit has been referenced. A patch is available under commit c9abe09421eb99bbf1cd7862a3d375e58a4eb9e4.

Critical Impact
Remote attackers holding low privileges on the Diameter network can crash the Open5GS HSS, disrupting subscriber authentication for IMS services.

Affected Products

Open5GS versions up to and including 2.8.0
Open5GS HSS component (src/hss/hss-cx-path.c)
Deployments exposing the Cx Diameter interface to reachable networks

Discovery Timeline

2026-08-24 - CVE CVE-2026-78186 published to NVD
2026-08-24 - Last updated in NVD database
Patch commit c9abe09421eb99bbf1cd7862a3d375e58a4eb9e4 published in the Open5GS GitHub repository

Technical Details for CVE-2026-78186

Vulnerability Analysis

Open5GS is an open-source implementation of 4G/5G core network functions. The HSS handles subscriber authentication over the Diameter Cx interface toward the Call Session Control Function (CSCF). The vulnerable code path processes the User-Name AVP without validating that the string is non-empty before passing it to downstream logic. When the AVP contains a zero-length string, the code reaches an internal assertion or invalid conversion routine that terminates the process. This turns a malformed Diameter message into a denial-of-service primitive against a core telecom function.

Root Cause

The root cause is missing input validation on the User-Name AVP in hss-cx-path.c. The function hss_cx_user_name_to_bcd() and the surrounding logic assumed a non-empty identity string. Supplying an empty value bypassed pre-conditions and reached an assertion path [CWE-617], causing abnormal termination rather than a controlled error response.

Attack Vector

An authenticated peer on the Diameter Cx interface, such as a compromised or malicious S-CSCF, sends a User-Authorization-Request (UAR) or Multimedia-Auth-Request (MAR) with a User-Name AVP set to an empty string. The HSS parses the message and hits the assertion, aborting the process. Repeated messages sustain the denial-of-service condition and prevent legitimate IMS registration.

// Patch: reject empty Cx identity AVPs in src/hss/hss-cx-path.c
         goto out;
     }
 
+    if (user_name[0] == '\0') {
+        ogs_error("Empty User-Name");
+        result_code = OGS_DIAM_INVALID_AVP_VALUE;
+        error_occurred = 1;
+        goto out;
+    }
+
     if (hss_cx_user_name_to_bcd(user_name,
                 imsi_or_msisdn_bcd, sizeof(imsi_or_msisdn_bcd)) == false) {
         ogs_error("Invalid User-Name BCD");
// Source: https://github.com/open5gs/open5gs/commit/c9abe09421eb99bbf1cd7862a3d375e58a4eb9e4

Detection Methods for CVE-2026-78186

Indicators of Compromise

Unexpected termination or restart of the open5gs-hssd process without operator action
Diameter Cx messages (UAR, MAR, SAR) arriving with an empty User-Name AVP
Repeated IMS registration failures across subscribers correlated with HSS restarts

Detection Strategies

Inspect Diameter traffic on the Cx interface for AVP code 1 (User-Name) with a zero-length value and alert on matches.
Monitor Open5GS logs for ogs_error entries and assertion or abort messages originating in hss-cx-path.c.
Correlate HSS process crashes with inbound Diameter peer activity to identify the offending source.

Monitoring Recommendations

Enable process supervision metrics (restart count, exit code) for open5gs-hssd and forward to a centralized log platform.
Capture Diameter packet metadata on the Cx interface with a network sensor and retain for post-incident analysis.
Track Diameter result codes; a spike in DIAMETER_INVALID_AVP_VALUE after patching indicates continued malicious probing.

How to Mitigate CVE-2026-78186

Immediate Actions Required

Apply the upstream patch by updating to an Open5GS build that includes commit c9abe09421eb99bbf1cd7862a3d375e58a4eb9e4.
Restrict Cx interface reachability to trusted CSCF peers using firewall rules or IPsec.
Enable process auto-restart for open5gs-hssd to reduce outage windows while patching is scheduled.

Patch Information

The fix is available in the Open5GS repository as commit c9abe09421eb99bbf1cd7862a3d375e58a4eb9e4, titled "hss: Reject empty Cx identity AVPs." The patch validates that user_name[0] is not the null terminator before invoking hss_cx_user_name_to_bcd() and returns OGS_DIAM_INVALID_AVP_VALUE when the AVP is empty. See the Open5GS commit and the associated GitHub issue #4675 for context.

Workarounds

Deploy a Diameter proxy or Diameter Routing Agent (DRA) that drops messages with empty User-Name AVPs before they reach the HSS.
Enforce peer authentication and network segmentation so only authorized S-CSCF and I-CSCF nodes can send Cx traffic.
Monitor and rate-limit Diameter peers that generate malformed requests, and revoke peer credentials on repeated violations.

bash

# Build and deploy the patched HSS from source
git clone https://github.com/open5gs/open5gs.git
cd open5gs
git checkout c9abe09421eb99bbf1cd7862a3d375e58a4eb9e4
meson build --prefix=/usr
ninja -C build
sudo ninja -C build install
sudo systemctl restart open5gs-hssd