CVE-2026-8187: Open5gs Open5gs DoS Vulnerability

CVE-2026-8187 Overview

CVE-2026-8187 is a resource consumption vulnerability [CWE-400] affecting Open5GS versions up to 2.7.7. The flaw resides in the _gtpv1_u_recv_cb function inside src/upf/gtp-path.c, which is part of the User Plane Function (UPF) component. Remote attackers can manipulate GTPv1-U traffic processing to exhaust resources on the affected node. The issue was reported to the Open5GS project through a public GitHub issue, but the maintainers have not yet responded with a fix.

Critical Impact
Remote, unauthenticated attackers can trigger resource consumption against the UPF component, degrading 4G/5G core network availability.

Affected Products

Open5GS versions up to and including 2.7.7
User Plane Function (UPF) component (src/upf/gtp-path.c)
Deployments exposing GTPv1-U interfaces to untrusted networks

Discovery Timeline

2026-05-09 - CVE-2026-8187 published to NVD
2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-8187

Vulnerability Analysis

Open5GS implements a 5G core and EPC stack used in mobile network deployments and research environments. The UPF handles user plane traffic and terminates GTPv1-U tunnels carrying subscriber data. The vulnerable callback _gtpv1_u_recv_cb processes inbound GTPv1-U packets received over the network. A manipulation of inbound traffic causes the function to consume excessive resources, leading to a denial of service condition on the UPF node. Because the UPF is central to user data forwarding, sustained resource exhaustion can disrupt subscriber traffic across the affected core network.

Root Cause

The defect is classified as uncontrolled resource consumption [CWE-400] within the GTPv1-U receive callback. The function fails to apply sufficient bounds or rate controls when handling crafted input, allowing an attacker to drive the UPF process into a degraded state. Technical specifics are tracked in the GitHub Open5GS Issue #4492 and the VulDB Vulnerability #362339 entry.

Attack Vector

The vulnerability is network-reachable and requires no authentication or user interaction. An attacker who can send GTPv1-U packets to the UPF can trigger the condition remotely. Operators that expose the N3 or S1-U interface to untrusted segments face the highest exposure. No public proof-of-concept exploit is currently available, and the EPSS probability stands at 0.032%.

No verified exploitation code is available. See the Open5GS repository and VulDB CTI for #362339 for additional technical context.

Detection Methods for CVE-2026-8187

Indicators of Compromise

Unusual spikes in CPU or memory utilization on Open5GS UPF processes
High volumes of malformed or anomalous GTPv1-U packets reaching the UPF on UDP port 2152
UPF service crashes, restarts, or unresponsive user plane sessions

Detection Strategies

Monitor Open5GS UPF process metrics for sustained resource exhaustion correlated with GTPv1-U inbound traffic.
Deploy network telemetry on the N3/S1-U interfaces to flag abnormal GTP-U packet rates or malformed headers from non-RAN sources.
Correlate UPF availability events with packet capture data covering the _gtpv1_u_recv_cb ingress path.

Monitoring Recommendations

Alert on UPF restarts, crash loops, or session drop rates exceeding baseline thresholds.
Log and review source addresses of GTPv1-U traffic to detect peers outside the expected gNB/eNB inventory.
Track CPU, memory, and packet processing latency on UPF hosts with automated thresholds.

How to Mitigate CVE-2026-8187

Immediate Actions Required

Restrict GTPv1-U (UDP 2152) ingress to the UPF so only authorized RAN nodes can reach the service.
Place the UPF behind segmented transport networks and remove any direct exposure to the public internet.
Apply rate limiting on GTP-U flows at upstream routers or firewalls to blunt resource exhaustion attempts.

Patch Information

No official patch has been released. The Open5GS maintainers had not responded to the public issue at the time of CVE publication. Track the GitHub Open5GS Issue #4492 and the Open5GS repository for upstream fixes, and review the VulDB Submission #800025 record for status updates.

Workarounds

Enforce strict access control lists permitting GTPv1-U traffic only from trusted base station IP ranges.
Deploy upstream packet filtering or IPS rules that drop malformed GTP-U packets before they reach the UPF.
Monitor UPF health and configure automated restart with backoff to limit the impact of denial of service attempts.

bash

# Example iptables rule restricting GTPv1-U to known RAN subnets
iptables -A INPUT -p udp --dport 2152 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p udp --dport 2152 -j DROP